Skip to content

Update fastapi to 0.140.6 #607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.140.6 #607

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.140.6

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo files =="
git ls-files | sed -n '1,120p'

echo "== requirements candidates =="
fd -i 'requirements.*\.txt|pyproject.*|poetry.*|Pipfile|environment.*' . -t f | sed -n '1,120p'

echo "== src/requirements.txt =="
if [ -f src/requirements.txt ]; then cat -n src/requirements.txt; fi

echo "== relevant package references =="
rg -n 'gitpython|uvicorn|fastapi|pydantic' -i . -g '!*.lock' -g '!node_modules' -g '!dist' -g '!build' | sed -n '1,200p'

Repository: salimfadhley/dockerized_python_playground

Length of output: 1077

🌐 Web query:

PyPI GitPython 3.1.9 vulnerability CVE 3.1.9 GitHub security advisories

💡 Result:

GitPython version 3.1.9 is affected by multiple critical security vulnerabilities due to its long history of improper input validation when constructing and executing Git commands [1][2][3]. Because GitPython passes user-supplied arguments directly to the underlying git binary, it has been susceptible to various forms of remote code execution (RCE) and arbitrary file manipulation [1][4][5]. Specifically, GitPython 3.1.9 is known to be vulnerable to the following classes of issues, among others: 1. Remote Code Execution (RCE) via insecure Git options: Earlier versions of GitPython failed to adequately block or sanitize dangerous Git options (such as --upload-pack, --config, or --receive-pack) when executing clone, fetch, pull, or push operations [1][2][6]. Attackers could inject these options to execute arbitrary commands on the system [4][6][5]. 2. Argument Injection and Arbitrary File Manipulation: Other public APIs, such as Repo.iter_commits and Repo.blame, previously lacked essential guards, allowing attackers to inject malicious flags that could lead to arbitrary file overwrites or command execution [5]. 3. Git Configuration Injection: Vulnerabilities have also been identified where improper sanitization of configuration values (e.g., embedding newlines) allowed attackers to manipulate Git configurations, such as core.hooksPath, to achieve code execution [7][6]. Due to the number of vulnerabilities identified in GitPython over time, version 3.1.9 is considered insecure [1][8]. Users are strongly advised to upgrade to the latest available version of GitPython to receive all security patches [8]. Official security advisories for GitPython can be tracked via the GitHub Advisory Database [1][5] and the PyPA advisory database [2][3].

Citations:

🌐 Web query:

PyPI uvicorn 0.4.6 vulnerability CVE 0.4.6 vulnerability scanner

💡 Result:

Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, as it precedes the fixed version 0.11.7 [1][2][3]. The identified vulnerabilities include: 1. CVE-2020-7694 (also identified as PYSEC-2020-150 and GHSA-33c7-2mpw-hg34): This is a log injection vulnerability where the request logger is susceptible to ANSI escape sequence injection [4][5][6]. An attacker can craft URLs with percent-encoded escape sequences to pollute access logs or interact with terminal emulators displaying the logs [4][5]. 2. CVE-2020-7695 (also identified as PYSEC-2020-151 and GHSA-f97h-2pfx-f59f): This is an HTTP response splitting vulnerability [7][3][8]. Because CRLF sequences are not properly escaped in HTTP header values, an attacker can exploit this to inject arbitrary headers or even return an arbitrary response body [7][3][8]. Security scanners will flag uvicorn 0.4.6 as vulnerable due to these issues. It is strongly recommended to update to a modern, supported version of uvicorn (the vulnerabilities were fixed in version 0.11.7) [1][2][3].

Citations:

🌐 Web query:

fastapi 0.140.6 python requires Pydantic Starlette requirements metadata

💡 Result:

As of FastAPI version 0.140.6, the framework specifies its core dependencies in the project's metadata (pyproject.toml). Specifically, for the 0.140.x release series, FastAPI requires the following core dependencies [1][2]: - Starlette: >=0.46.0 [1][2] - Pydantic: >=2.9.0 [1][2] In addition to these, FastAPI also requires: - typing-extensions: >=4.8.0 [1][2] - typing-inspection: >=0.4.2 [1][2] - annotated-doc: >=0.0.2 [1][2] FastAPI does not strictly pin the upper versions of these dependencies to allow for flexibility and compatibility across different user environments [3][4]. Users are encouraged to maintain updated dependency versions for their projects [4]. When installing FastAPI with standard optional features (using fastapi[standard]), it also includes additional packages such as httpx, jinja2, python-multipart, email-validator, and uvicorn[standard] [1][2].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

paths = {"pyproject": Path("pyproject.toml"), "src/pyproject.toml": Path("src/pyproject.toml")}
for name, p in paths.items():
    print(f"== {name} ==")
    print("exists:", p.exists())
    if p.exists():
        print(p.read_text()[:2000])

for path in (Path("src/requirements.txt"), Path("src/requirements_dev.txt")):
    print(f"== {path} ==")
    if path.exists():
        for i, line in enumerate(path.read_text().splitlines(), 1):
            print(f"{i}: {line}")
PY

python3 - <<'PY'
import urllib.request
packages = ["GitPython", "uvicorn", "fastapi"]
for package in packages:
    url = f"https://pypi.org/pypi/{package}/json"
    with urllib.request.urlopen(url, timeout=20) as r:
        data = __import__("json").loads(r.read())
    releases = list(data.get("releases", {}).keys())
    sorted_releases = sorted(releases, key=lambda v: tuple(map(int, v.split(".")[:3])), reverse=True)
    print(f"== {package} latest versions (first 5) ==")
    print("\n".join(f"{v} -> {data['releases'].get(v)[0].get('requires_python')!r}" for v in sorted_releases[:5]))
    print("latest:", sorted_releases[0] if sorted_releases else None)
PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 2684

🌐 Web query:

site:github.com/salimfadhley/dockerized_python_playground src requirements.txt

💡 Result:

I couldn’t find a GitHub result for salimfadhley/dockerized_python_playground from that query. The search returned other Python/Docker repos instead, but not that exact repository. (github.com)

If you want, I can try a different query or look for the specific src / requirements.txt files in the repo.

Citations:

🌐 Web query:

GitHub vulnerability database gitpython 3.1.9 CVE GHSA

💡 Result:

GitPython version 3.1.9 is significantly outdated and is affected by multiple high-severity security vulnerabilities documented in the GitHub Advisory Database and CVE system [1][2][3]. Because of its age, it lacks critical security patches for several remote code execution (RCE) and command injection flaws identified in later releases [1][4][5][6][7]. Key security vulnerabilities affecting GitPython 3.1.9 include: 1. Remote Code Execution (RCE) via improper input validation: GitPython versions before 3.1.32 are vulnerable to RCE because they do not correctly block insecure options in clone and clone_from commands (CVE-2023-40267 / GHSA-pr76-5cm5-w9cj) [1][2]. This is an incomplete fix for an earlier vulnerability, CVE-2022-24439 [1][2]. 2. Untrusted search path on Windows: Versions including 3.1.9 may be vulnerable to arbitrary code execution on Windows systems because the library can resolve to malicious git or bash executables present in the current working directory (CVE-2023-40590 / GHSA-2mqj-m65w-jghx) [4][8]. 3. Command Injection and Option Bypasses: Later vulnerabilities (such as CVE-2026-42215 and CVE-2026-42284, published in 2026) highlight ongoing issues with command injection via bypasses of Git option safety checks [6][7]. Additionally, newer advisories (e.g., GHSA-956x-8gvw-wg5v) identify vulnerabilities in functions like Repo.archive and Repo.iter_commits that remained unpatched in many older versions [5][9]. Due to these risks, it is strongly recommended to upgrade to the latest available version of GitPython to ensure all known security patches are applied [5][9][6][7]. You can review specific vulnerabilities and their remediation status in the GitHub Advisory Database [10].

Citations:

🌐 Web query:

GitHub vulnerability database uvicorn 0.4.6 CVE GHSA

💡 Result:

Uvicorn version 0.4.6 is affected by multiple security vulnerabilities, all of which were addressed in version 0.11.7 [1][2][3]. The primary vulnerabilities associated with this version are: 1. Log injection (GHSA-33c7-2mpw-hg34 / CVE-2020-7694): The request logger in Uvicorn is vulnerable to ANSI escape sequence injection [2][4]. Attackers can exploit this by requesting crafted URLs containing percent-encoded escape sequences, which are decoded by the logging component. This allows attackers to pollute access logs or potentially interact with the terminal emulator displaying those logs [2][5]. 2. HTTP response splitting (GHSA-f97h-2pfx-f59f / CVE-2020-7695): Uvicorn versions prior to 0.11.7 do not properly escape CRLF sequences in HTTP header values [1][6]. Attackers can exploit this to inject arbitrary headers or even return arbitrary response bodies when crafted input is used to construct HTTP headers [1][7]. These issues are documented in the GitHub Advisory Database and are consistently identified as affecting versions of Uvicorn earlier than 0.11.7, including 0.4.6 [1][2][8][3].

Citations:

Resolve the vulnerable dependencies before merging.

src/requirements.txt resolves gitpython==3.1.9, which is affected by RCE/command-injection advisories, and pins uvicorn==0.4.6, which is affected by log injection and HTTP response-splitting CVEs; both packages have substantially newer patched releases. Upgrade or remove these dependencies and rerun the vulnerability scan.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the dependency pins in
requirements.txt to patched releases of GitPython and uvicorn, or remove them if
unused; ensure the resolved versions no longer include gitpython==3.1.9 or
uvicorn==0.4.6, then rerun the vulnerability scan.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6