Skip to content

Update fastapi to 0.140.1 #605

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
+1 −1
Closed

Update fastapi to 0.140.1 #605

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.140.1

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== requirements file =="
if [ -f src/requirements.txt ]; then
  cat -n src/requirements.txt
else
  echo "src/requirements.txt not found"
  fd -a 'requirements\.txt$' .
fi

echo
echo "== uvicorn references =="
rg -n "uvicorn|fastapi" . -g '!dist' -g '!build' -g '!node_modules' || true

echo
echo "== repo files overview =="
git ls-files | sed -n '1,120p'

Repository: salimfadhley/dockerized_python_playground

Length of output: 961

🌐 Web query:

fastapi 0.140.1 uvicorn required version supported Python versions

💡 Result:

For FastAPI version 0.140.1 (noting that the latest release is 0.140.0 as of July 27, 2026), the requirements are as follows: Uvicorn Requirement: FastAPI requires Uvicorn version 0.12.0 or higher [1][2]. This is specified in the package's pyproject.toml file as uvicorn[standard] >=0.12.0 [1][2]. Supported Python Versions: FastAPI requires Python 3.10 or higher [1][3][2]. Note: As of July 27, 2026, the most recent version of FastAPI is 0.140.0, which was published on July 24, 2026 [4][5]. If you meant 0.140.0, the details above apply.

Citations:

🌐 Web query:

OSV uvicorn 0.4.6 vulnerabilities

💡 Result:

Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, all of which were addressed in version 0.11.7 [1][2]. These vulnerabilities include: 1. HTTP Response Splitting (CVE-2020-7695 / GHSA-f97h-2pfx-f59f): Uvicorn's implementation of the HTTP protocol for the httptools parser failed to properly escape CRLF sequences in HTTP headers [1][3]. This allowed attackers to inject arbitrary headers or arbitrary response bodies into HTTP responses using crafted input [1][3]. 2. Log Injection (CVE-2020-7694 / GHSA-33c7-2mpw-hg34): The default request logger was vulnerable to ANSI escape sequence injection [4][5][6]. Attackers could request URLs containing crafted percent-encoded escape sequences, which would then be logged by Uvicorn. This enabled attackers to pollute access logs and potentially interact with the terminal emulator displaying those logs [4][5][6]. It is strongly recommended to upgrade to a version of Uvicorn later than 0.11.7 to mitigate these and any subsequent security issues [1][2].

Citations:

Update the vulnerable Uvicorn pin alongside the FastAPI upgrade.

uvicorn==0.4.6 remains in src/requirements.txt and is affected by high-severity vulnerabilities that are fixed in later patched releases. Pin it to a patched release compatible with the supported Python version, then rerun the vulnerability scan.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the uvicorn dependency pin in
src/requirements.txt from 0.4.6 to a patched release compatible with the
supported Python version, alongside the FastAPI upgrade, then rerun the
vulnerability scan to verify the issue is resolved.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6