Update fastapi to 0.140.2 - #606
Conversation
📝 WalkthroughWalkthroughUpdates runtime dependency declarations by upgrading FastAPI, ensuring GitPython is listed, and retaining the pinned Uvicorn version. ChangesRuntime dependency updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Around line 2-3: Update the dependency declarations in requirements.txt: pin
gitpython to an approved patched version and raise uvicorn from 0.4.6 to a
supported patched release, such as 0.11.7 or newer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Files named requirements.txt:\n'
fd -a 'requirements\.txt$' . | sed 's#^\./##'
printf '\nsrc/requirements.txt context:\n'
if [ -f src/requirements.txt ]; then
cat -n src/requirements.txt
fi
printf '\nReferences to GitPython/GitPython versions:\n'
rg -n -i 'gitpython|uvicorn==0\.4\.6|uvicorn' -S . || true
printf '\nProject files likely config:\n'
git ls-files | rg '(^|/)(pyproject\.toml|poetry\.lock|Pipfile|Pipfile\.lock|requirements.*\.txt|setup\.py|setup\.cfg|tox\.ini|Dockerfile)$' | sed -n '1,120p'Repository: salimfadhley/dockerized_python_playground
Length of output: 563
🌐 Web query:
PyPI GitPython 3.1.9 JSON metadata version 3.1.9 vulnerabilities
💡 Result:
GitPython version 3.1.9, released on October 1, 2020, is an old version that is affected by multiple security vulnerabilities discovered and documented after its release [1][2]. Because GitPython is designed to interact with the Git binary, it has historically been susceptible to issues involving improper input validation and command injection [3][4][5]. Key vulnerabilities affecting GitPython 3.1.9 include, but are not limited to: Remote Code Execution (RCE) / Command Injection: Version 3.1.9 is vulnerable to various forms of command injection due to insufficient sanitization of input arguments when interacting with the Git CLI [6][3][5]. Specifically, CVE-2022-24439 identifies that insecure non-multi options in clone and clone_from can lead to RCE [3]. Subsequent vulnerabilities, such as CVE-2026-42215, further highlighted that certain Python keyword arguments (kwargs) could bypass safety checks and lead to arbitrary command execution [5][7]. Arbitrary File Overwrite: Other vulnerabilities, such as those documented in security advisories like GHSA-956x-8gvw-wg5v, have identified that various APIs (e.g., Repo.iter_commits, Repo.blame) fail to properly sanitize input, potentially allowing an attacker to trigger arbitrary file overwrites or other malicious actions [4]. Path Traversal / File Manipulation: Vulnerabilities such as CVE-2026-44243 affect older versions (patched in 3.1.48) and allow for file operations outside the intended directory when processing crafted reference paths [8]. As of July 2026, the GitPython project has released numerous updates to address these and other security flaws [2]. Users of version 3.1.9 are strongly advised to upgrade to the latest stable release to mitigate these risks [2][4]. The project maintainers emphasize using only official releases from PyPI to ensure integrity [9].
Citations:
- 1: https://pypi.org/project/GitPython/3.1.9/
- 2: https://pypi.org/project/GitPython/
- 3: https://nvd.nist.gov/vuln/detail/cve-2022-24439
- 4: GHSA-956x-8gvw-wg5v
- 5: https://nvd.nist.gov/vuln/detail/CVE-2026-42215
- 6: https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj
- 7: GHSA-rpm5-65cw-6hj4
- 8: https://github.com/pypa/advisory-database/blob/main/vulns/gitpython/PYSEC-2026-2162.yaml
- 9: https://pypi.org/project/GitPython/3.1.32/
🌐 Web query:
PyPI uvicorn 0.4.6 JSON metadata version 0.4.6 vulnerabilities HTTP response splitting log injection
💡 Result:
Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, specifically log injection and HTTP response splitting, which were subsequently addressed in version 0.11.7 [1][2][3]. Log Injection (CVE-2020-7694) Uvicorn's request logger was vulnerable to ANSI escape sequence injection [1][4]. Attackers could send crafted URLs containing percent-encoded escape sequences that, once processed and logged by the server, would be decoded [4][5]. This allowed attackers to pollute logs or interact with terminal emulators displaying those logs [1][4]. HTTP Response Splitting (CVE-2020-7695) Uvicorn was vulnerable to HTTP response splitting because it failed to properly escape carriage return and line feed (CRLF) sequences in HTTP header values [2][6]. This allowed attackers to inject arbitrary headers or even influence the response body when user-controlled input was used to construct HTTP headers [2][6]. For security, it is highly recommended to upgrade to a newer, patched version (0.11.7 or later) [2][6][3]. The metadata for Uvicorn 0.4.6, including its dependency specifications in older formats like setup.py, can be viewed via PyPI and various security advisory databases that track these vulnerabilities [7][3].
Citations:
- 1: https://www.versioneye.com/Python/uvicorn/0.4.6
- 2: GHSA-f97h-2pfx-f59f
- 3: https://pypi.org/project/uvicorn/0.4.6/
- 4: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 5: https://osv.dev/vulnerability/PYSEC-2020-150
- 6: https://security.snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
- 7: https://deps.dev/pypi/uvicorn/0.4.6
Replace the vulnerable dependency declarations.
src/requirements.txt declares gitpython without a version constraint and pins uvicorn==0.4.6; both are known vulnerable. Pin an approved patched version for gitpython and upgrade uvicorn to a supported release such as 0.11.7 or newer.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` around lines 2 - 3, Update the dependency declarations
in requirements.txt: pin gitpython to an approved patched version and raise
uvicorn from 0.4.6 to a supported patched release, such as 0.11.7 or newer.
Source: Linters/SAST tools
|
Closing this in favor of #607 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.2.
Changelog
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0