Skip to content

Update fastapi to 0.140.2 #606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.140.2 #606

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.140.2
gitpython
uvicorn==0.4.6
Comment on lines 2 to 3

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Files named requirements.txt:\n'
fd -a 'requirements\.txt$' . | sed 's#^\./##'

printf '\nsrc/requirements.txt context:\n'
if [ -f src/requirements.txt ]; then
  cat -n src/requirements.txt
fi

printf '\nReferences to GitPython/GitPython versions:\n'
rg -n -i 'gitpython|uvicorn==0\.4\.6|uvicorn' -S . || true

printf '\nProject files likely config:\n'
git ls-files | rg '(^|/)(pyproject\.toml|poetry\.lock|Pipfile|Pipfile\.lock|requirements.*\.txt|setup\.py|setup\.cfg|tox\.ini|Dockerfile)$' | sed -n '1,120p'

Repository: salimfadhley/dockerized_python_playground

Length of output: 563

🌐 Web query:

PyPI GitPython 3.1.9 JSON metadata version 3.1.9 vulnerabilities

💡 Result:

GitPython version 3.1.9, released on October 1, 2020, is an old version that is affected by multiple security vulnerabilities discovered and documented after its release [1][2]. Because GitPython is designed to interact with the Git binary, it has historically been susceptible to issues involving improper input validation and command injection [3][4][5]. Key vulnerabilities affecting GitPython 3.1.9 include, but are not limited to: Remote Code Execution (RCE) / Command Injection: Version 3.1.9 is vulnerable to various forms of command injection due to insufficient sanitization of input arguments when interacting with the Git CLI [6][3][5]. Specifically, CVE-2022-24439 identifies that insecure non-multi options in clone and clone_from can lead to RCE [3]. Subsequent vulnerabilities, such as CVE-2026-42215, further highlighted that certain Python keyword arguments (kwargs) could bypass safety checks and lead to arbitrary command execution [5][7]. Arbitrary File Overwrite: Other vulnerabilities, such as those documented in security advisories like GHSA-956x-8gvw-wg5v, have identified that various APIs (e.g., Repo.iter_commits, Repo.blame) fail to properly sanitize input, potentially allowing an attacker to trigger arbitrary file overwrites or other malicious actions [4]. Path Traversal / File Manipulation: Vulnerabilities such as CVE-2026-44243 affect older versions (patched in 3.1.48) and allow for file operations outside the intended directory when processing crafted reference paths [8]. As of July 2026, the GitPython project has released numerous updates to address these and other security flaws [2]. Users of version 3.1.9 are strongly advised to upgrade to the latest stable release to mitigate these risks [2][4]. The project maintainers emphasize using only official releases from PyPI to ensure integrity [9].

Citations:

🌐 Web query:

PyPI uvicorn 0.4.6 JSON metadata version 0.4.6 vulnerabilities HTTP response splitting log injection

💡 Result:

Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, specifically log injection and HTTP response splitting, which were subsequently addressed in version 0.11.7 [1][2][3]. Log Injection (CVE-2020-7694) Uvicorn's request logger was vulnerable to ANSI escape sequence injection [1][4]. Attackers could send crafted URLs containing percent-encoded escape sequences that, once processed and logged by the server, would be decoded [4][5]. This allowed attackers to pollute logs or interact with terminal emulators displaying those logs [1][4]. HTTP Response Splitting (CVE-2020-7695) Uvicorn was vulnerable to HTTP response splitting because it failed to properly escape carriage return and line feed (CRLF) sequences in HTTP header values [2][6]. This allowed attackers to inject arbitrary headers or even influence the response body when user-controlled input was used to construct HTTP headers [2][6]. For security, it is highly recommended to upgrade to a newer, patched version (0.11.7 or later) [2][6][3]. The metadata for Uvicorn 0.4.6, including its dependency specifications in older formats like setup.py, can be viewed via PyPI and various security advisory databases that track these vulnerabilities [7][3].

Citations:

Replace the vulnerable dependency declarations.

src/requirements.txt declares gitpython without a version constraint and pins uvicorn==0.4.6; both are known vulnerable. Pin an approved patched version for gitpython and upgrade uvicorn to a supported release such as 0.11.7 or newer.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` around lines 2 - 3, Update the dependency declarations
in requirements.txt: pin gitpython to an approved patched version and raise
uvicorn from 0.4.6 to a supported patched release, such as 0.11.7 or newer.

Source: Linters/SAST tools