Update fastapi to 0.140.1 - #605
Conversation
📝 WalkthroughWalkthroughFastAPI is upgraded from version 0.6.4 to 0.140.1 in ChangesFastAPI dependency upgrade
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the uvicorn dependency pin in src/requirements.txt from 0.4.6
to a patched release compatible with the supported Python version, alongside the
FastAPI upgrade, then rerun the vulnerability scan to verify the issue is
resolved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.140.1 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== requirements file =="
if [ -f src/requirements.txt ]; then
cat -n src/requirements.txt
else
echo "src/requirements.txt not found"
fd -a 'requirements\.txt$' .
fi
echo
echo "== uvicorn references =="
rg -n "uvicorn|fastapi" . -g '!dist' -g '!build' -g '!node_modules' || true
echo
echo "== repo files overview =="
git ls-files | sed -n '1,120p'Repository: salimfadhley/dockerized_python_playground
Length of output: 961
🌐 Web query:
fastapi 0.140.1 uvicorn required version supported Python versions
💡 Result:
For FastAPI version 0.140.1 (noting that the latest release is 0.140.0 as of July 27, 2026), the requirements are as follows: Uvicorn Requirement: FastAPI requires Uvicorn version 0.12.0 or higher [1][2]. This is specified in the package's pyproject.toml file as uvicorn[standard] >=0.12.0 [1][2]. Supported Python Versions: FastAPI requires Python 3.10 or higher [1][3][2]. Note: As of July 27, 2026, the most recent version of FastAPI is 0.140.0, which was published on July 24, 2026 [4][5]. If you meant 0.140.0, the details above apply.
Citations:
- 1: https://pypi.org/project/fastapi/0.140.0/
- 2: https://github.com/fastapi/fastapi/blob/0.139.2/pyproject.toml
- 3: https://pypi.org/project/fastapi/
- 4: https://github.com/fastapi/fastapi/releases/tag/0.140.0
- 5: https://fastapi.tiangolo.com/release-notes/
🌐 Web query:
OSV uvicorn 0.4.6 vulnerabilities
💡 Result:
Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, all of which were addressed in version 0.11.7 [1][2]. These vulnerabilities include: 1. HTTP Response Splitting (CVE-2020-7695 / GHSA-f97h-2pfx-f59f): Uvicorn's implementation of the HTTP protocol for the httptools parser failed to properly escape CRLF sequences in HTTP headers [1][3]. This allowed attackers to inject arbitrary headers or arbitrary response bodies into HTTP responses using crafted input [1][3]. 2. Log Injection (CVE-2020-7694 / GHSA-33c7-2mpw-hg34): The default request logger was vulnerable to ANSI escape sequence injection [4][5][6]. Attackers could request URLs containing crafted percent-encoded escape sequences, which would then be logged by Uvicorn. This enabled attackers to pollute access logs and potentially interact with the terminal emulator displaying those logs [4][5][6]. It is strongly recommended to upgrade to a version of Uvicorn later than 0.11.7 to mitigate these and any subsequent security issues [1][2].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
- 2: https://pypi.org/project/uvicorn/0.4.6/
- 3: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 4: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 5: https://nvd.nist.gov/vuln/detail/cve-2020-7694
- 6: GHSA-33c7-2mpw-hg34
Update the vulnerable Uvicorn pin alongside the FastAPI upgrade.
uvicorn==0.4.6 remains in src/requirements.txt and is affected by high-severity vulnerabilities that are fixed in later patched releases. Pin it to a patched release compatible with the supported Python version, then rerun the vulnerability scan.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the uvicorn dependency pin in
src/requirements.txt from 0.4.6 to a patched release compatible with the
supported Python version, alongside the FastAPI upgrade, then rerun the
vulnerability scan to verify the issue is resolved.
Source: Linters/SAST tools
|
Closing this in favor of #606 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.1.
Changelog
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8