Update fastapi to 0.140.0 - #602
Conversation
📝 WalkthroughWalkthroughFastAPI is upgraded from version 0.6.4 to 0.140.0 in the project requirements. ChangesFastAPI dependency upgrade
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Around line 1-3: Update the dependency declarations in requirements.txt by
pinning gitpython to a patched release and upgrading uvicorn from 0.4.6 to a
supported patched version; leave fastapi unchanged and ensure neither dependency
remains vulnerable or unconstrained.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| fastapi==0.140.0 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository files relevant to dependencies =="
git ls-files | rg '(^|/)(requirements.*\.txt|pyproject\.toml|Pipfile|poetry\.lock|uv\.lock|environment\.yml|setup\.py|setup\.cfg)$' || true
echo
echo "== src/requirements.txt with line numbers =="
if [ -f src/requirements.txt ]; then
cat -n src/requirements.txt
else
echo "src/requirements.txt not found"
fi
echo
echo "== dependency mentions =="
rg -n "fastapi|gitpython|uvicorn|pydantic|starlette|python" -S src requirements* pyproject.toml setup.py setup.cfg 2>/dev/null || true
echo
echo "== package resolution metadata from PyPI (static metadata) =="
python3 - <<'PY'
import json
import urllib.request
def get(url, timeout=15):
req = urllib.request.Request(url, headers={"User-Agent":"coderabbit-verifier/0.1"})
with urllib.request.urlopen(req, timeout=timeout) as r:
return json.load(r)
for name, version in [("GitPython", "3.1.9"), ("uvicorn", "0.4.6"), ("FastAPI", "0.140.0")]:
print(f"\n--- {name}=={version} ---")
try:
meta = get(f"https://pypi.org/pypi/{name}/{version}/json")
print("requires_python:", meta["info"].get("requires_python"))
print("requires_dist:")
for req in meta["info"].get("requires_dist", []):
if req:
print(" ", req)
vuln_report = meta.get("vulnerabilities") or []
print("vulnerabilities_found:", len(vuln_report), [v.get("ids") or v.get("fixed_in") or v.get("affecting_versions") for v in vuln_report[:10]])
except Exception as e:
print("ERROR", type(e).__name__, e)
print("\n--- FastAPI 0.140.0 classifiers/dependencies ---")
meta = get("https://pypi.org/pypi/FastAPI/0.140.0/json")
print("python_requires:", meta["info"].get("python_requires"))
for req in meta["info"].get("requires_dist", []):
print(" ", req)
PY
echo
echo "== security advisories / GHSA mentions in repository =="
rg -n "GHSA|vulnerabilité|vulnerability|CVE-|gitpython|3\.1\.9|uvicorn|0\.4\.6" -S . 2>/dev/null || trueRepository: salimfadhley/dockerized_python_playground
Length of output: 4056
🌐 Web query:
OSS-Fuzz / GitHub advisory GitPython 3.1.9 vulnerability
💡 Result:
GitPython version 3.1.9 is an outdated release that is affected by multiple security vulnerabilities discovered over several years [1][2][3]. Because GitPython has been the subject of numerous critical security advisories related to command injection, remote code execution, and path traversal, version 3.1.9 is considered insecure and should not be used in production environments [4][5][6][7]. Many of the vulnerabilities identified in GitPython stem from insufficient sanitization of user-controlled input when calling the underlying git binary, or improper validation of Git options and repository URLs [4][5][8][6]. Examples of security issues affecting versions like 3.1.9 include: 1. Remote Code Execution (RCE) and Command Injection: Multiple vulnerabilities (such as CVE-2022-24439, CVE-2023-40267, and others) have been documented where attackers can inject malicious arguments or git options via API methods like Repo.clone_from, Repo.clone, or various remote operations [5][1][2][6]. 2. Arbitrary File Access: Newer vulnerabilities, such as CVE-2026-44243, allow for path traversal, enabling arbitrary file writes or deletions outside the intended repository directory [7]. 3. Environment Variable Exfiltration: Some versions allow for the disclosure of environment variables via improper handling of remote URLs [8]. These issues are tracked through various platforms, including the GitHub Advisory Database and OSV (Open Source Vulnerabilities) [1][2][9]. The GitPython project has released numerous patches (e.g., versions 3.1.32, 3.1.47, 3.1.49, 3.1.51) to address these flaws [4][5][8][6][7][3]. To secure your application, you should update GitPython to the latest available stable version. You can verify your current version and check for the latest releases on the official PyPI page for the gitpython package. If you are using GitPython in a security-sensitive context, it is strongly recommended to review the project's security advisories on GitHub for a complete list of patched vulnerabilities and recommended security practices [4][5][6][7].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj
- 2: https://github.com/pypa/advisory-database/blob/main/vulns/gitpython/PYSEC-2023-137.yaml
- 3: https://app.opencve.io/cve/?product=gitpython&vendor=gitpython_project
- 4: GHSA-956x-8gvw-wg5v
- 5: GHSA-rpm5-65cw-6hj4
- 6: GHSA-x2qx-6953-8485
- 7: GHSA-7545-fcxq-7j24
- 8: GHSA-rwj8-pgh3-r573
- 9: https://osv.dev/vulnerability/CVE-2026-42284
🌐 Web query:
GitHub Advisory uvicorn 0.4.6 vulnerability
💡 Result:
Uvicorn version 0.4.6 is affected by multiple security vulnerabilities [1][2][3]. Because it is older than version 0.11.7, it is specifically vulnerable to the following issues: 1. Log Injection (CVE-2020-7694): The request logger in Uvicorn versions prior to 0.11.7 is vulnerable to ANSI escape sequence injection [4][5]. Attackers can use crafted URLs with percent-encoded escape sequences to pollute access logs or potentially interact with terminal emulators displaying those logs [4][6]. 2. HTTP Response Splitting (CVE-2020-7695): Uvicorn versions prior to 0.11.7 are vulnerable to HTTP response splitting because CRLF (Carriage Return Line Feed) sequences are not properly escaped in HTTP header values [2][5][7]. This allows an attacker to inject arbitrary headers or potentially return an arbitrary response body when crafted input is used to construct HTTP headers [2][7]. These issues were resolved in Uvicorn version 0.11.7 [4][2][5]. Users are strongly advised to update to a more recent version of Uvicorn to mitigate these and other potential vulnerabilities [3][8].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 2: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
- 3: https://www.versioneye.com/Python/uvicorn/0.4.6
- 4: GHSA-33c7-2mpw-hg34
- 5: Safety Check Reports 2 Vulnerabilities: CVE-2020-7694 and CVE-2020-7695 Kludex/uvicorn#749
- 6: https://osv.dev/vulnerability/PYSEC-2020-150
- 7: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 8: https://security.snyk.io/package/pip/uvicorn
🌐 Web query:
GitHub Advisory GitPython 3.1.9 CVE
💡 Result:
GitPython version 3.1.9 is affected by multiple security vulnerabilities due to its long history of issues related to improper input validation and command injection [1][2]. Specifically, this version is vulnerable to the following documented CVEs and security advisories: - CVE-2022-24439 (GHSA-hcpj-qp55-gfph): This is a critical Remote Code Execution (RCE) vulnerability stemming from improper user input validation, which allows the injection of malicious arguments into Git commands [1]. This was fixed in version 3.1.30 [1][2]. Because GitPython 3.1.9 predates many subsequent security fixes, it is also vulnerable to a wide range of other issues discovered after its release, including: - CVE-2023-40267 (GHSA-pr76-5cm5-w9cj): An RCE vulnerability caused by insufficient sanitization of input arguments in clone and clone_from functions, identified as an incomplete fix for CVE-2022-24439. This was fixed in 3.1.32 [3][4][2]. - CVE-2023-40590 (GHSA-wfm5-v35h-vwf4): An issue fixed in 3.1.33 [5][2]. - CVE-2024-22190 (GHSA-2mqj-m65w-jghx): An RCE vulnerability on Windows related to untrusted search paths, fixed in 3.1.41 [6][7]. As of July 2026, the GitPython project has seen numerous additional security advisories (e.g., GHSA-956x-8gvw-wg5v, GHSA-v396-v7q4-x2qj, GHSA-2f96-g7mh-g2hx) released to address ongoing challenges with command injection and option handling [8][9][10]. Due to these cumulative vulnerabilities, users of GitPython 3.1.9 are strongly advised to upgrade to the latest stable version of the library to ensure these flaws are patched [1][2][10].
Citations:
- 1: GHSA-hcpj-qp55-gfph
- 2: https://pypi.org/project/GitPython/3.1.9/
- 3: https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj
- 4: https://github.com/pypa/advisory-database/blob/main/vulns/gitpython/PYSEC-2023-137.yaml
- 5: https://nvd.nist.gov/vuln/detail/CVE-2023-40590
- 6: GHSA-2mqj-m65w-jghx
- 7: https://osv.dev/vulnerability/PYSEC-2024-4
- 8: GHSA-956x-8gvw-wg5v
- 9: GHSA-v396-v7q4-x2qj
- 10: https://github.com/gitpython-developers/GitPython/security/advisories
🌐 Web query:
FastAPI 0.140.0 requires Python 3.10 Pydantic Starlette dependencies
💡 Result:
As of July 24, 2026, FastAPI 0.140.0 has not been released. The latest available stable version of FastAPI is 0.139.2, which was released on July 16, 2026 [1][2]. Regarding the dependency requirements for recent versions of FastAPI (such as 0.139.x), the framework requires Python 3.10 or higher [1]. Its core dependencies include Pydantic (typically version 2.9.0 or higher) and Starlette (typically version 0.46.0 or higher) [1][3]. These requirements are subject to change in future releases, and you should always check the official FastAPI release notes or the PyPI project page for the most accurate information regarding a specific version once it becomes available [1][3].
Citations:
- 1: https://pypi.org/project/fastapi/
- 2: https://releasealert.dev/pypi/fastapi
- 3: https://fastapi.tiangolo.com/release-notes/
Do not merge with the vulnerable dependencies still declared here.
uvicorn==0.4.6 exposes ANSI log injection and HTTP response splitting, and resolving gitpython without a pinned constraint can still pull an affected release such as 3.1.9, which has multiple unpatched critical RCE flaws. Pin gitpython to a patched release and upgrade uvicorn to a supported, patched version before merging.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` around lines 1 - 3, Update the dependency declarations
in requirements.txt by pinning gitpython to a patched release and upgrading
uvicorn from 0.4.6 to a supported patched version; leave fastapi unchanged and
ensure neither dependency remains vulnerable or unconstrained.
Source: Linters/SAST tools
|
Closing this in favor of #605 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.0.
Changelog
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8