Update fastapi to 0.140.8 - #609
Conversation
📝 WalkthroughWalkthroughUpdates the pinned FastAPI dependency in ChangesFastAPI dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the repository’s CI/runtime Python target, especially the
python version declared in .travis.yml, to Python 3.10 or newer before retaining
fastapi==0.140.8 in requirements.txt. Ensure the declared deployable and CI
runtime satisfies FastAPI’s minimum version requirement.
- Around line 1-3: Update the dependency declarations in requirements.txt to use
patched, FastAPI-compatible versions by pinning GitPython to 3.1.53 and Uvicorn
to 0.51.0, or remove GitPython if it is not required at runtime; leave the
existing FastAPI dependency unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.140.8 | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n --hidden -g '!.git' \
'requires-python|python_requires|python-version|FROM python:' .Repository: salimfadhley/dockerized_python_playground
Length of output: 179
🌐 Web query:
FastAPI 0.140.8 Python version requires Python >=3.10 PyPI
💡 Result:
Yes, FastAPI version 0.140.8 requires Python >=3.10. This requirement is specified in the package metadata and pyproject.toml configuration [1][2][3].
Citations:
- 1: https://pypi.org/project/fastapi/
- 2: https://github.com/fastapi/fastapi/blob/0.139.2/pyproject.toml
- 3: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
🏁 Script executed:
#!/bin/bash
set -e
printf 'Tracked files / config candidates:\n'
git ls-files | rg -n '(^|/)(\.github/[^/]*/[^/]*\.ya?ml$|Dockerfile|docker-compose.*\.ya?ml$|\.python-version$|pyproject\.toml$|setup\.py$|requirements.*\.txt$|tox\.ini$|Pipfile$|poetry\.lock$)' || true
printf '\nFastAPI / package/config snippets:\n'
if [ -f src/requirements.txt ]; then cat -n src/requirements.txt; fi
rg -n --hidden -g '!.git' 'fastapi|python_requires|requires-python|python-version|FROM python|python:' . || trueRepository: salimfadhley/dockerized_python_playground
Length of output: 516
🏁 Script executed:
#!/bin/bash
set -e
printf 'Dockerfile:\n'
cat -n Dockerfile
printf '\ndocker-compose.yaml:\n'
cat -n docker-compose.yaml
printf '\nsrc/setup.py:\n'
cat -n src/setup.py
printf '\n.travis.yml:\n'
cat -n .travis.yml
printf '\npyproject/setup dependency indicators:\n'
rg -n --hidden -g '!.git' 'fastapi|python_requires|requires-python|python_version|python_requires|Programming Language :: Python|python_version|INSTALL_REQUIRES' . || trueRepository: salimfadhley/dockerized_python_playground
Length of output: 2593
Verify the CI/runtime Python before adopting FastAPI 0.140.8.
FastAPI 0.140.8 requires Python >=3.10, but the repo still defines CI/deployable runs in .travis.yml (python: 3.6) and does not declare a runtime/version constraint elsewhere. Add or update the CI/runtime Python target before installing this dependency.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the repository’s CI/runtime Python
target, especially the python version declared in .travis.yml, to Python 3.10 or
newer before retaining fastapi==0.140.8 in requirements.txt. Ensure the declared
deployable and CI runtime satisfies FastAPI’s minimum version requirement.
| fastapi==0.140.8 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
pip-audit -r src/requirements.txt --strictRepository: salimfadhley/dockerized_python_playground
Length of output: 226
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== requirements =="
cat -n src/requirements.txt
echo
echo "== local pip info if available =="
python3 - <<'PY'
import importlib.util, json, urllib.request, urllib.error, os
keys = ["fastapi", "gitpython", "uvicorn"]
for key in keys:
print(f"\n-- {key} --")
try:
url = f"https://pypi.org/pypi/{key}/json"
with urllib.request.urlopen(url, timeout=10) as r:
data = json.load(r)
info = data.get("info", {})
print("latest:", info.get("version"))
releases = list(data.get("releases", {}).keys())
print("release_count:", len(releases))
print("recent:", releases[-5:])
print("selected urls:", sorted(
[u.get("filename") for u in data.get("releases", {}).get("3.1.9", [])
+ data.get("releases", {}).get("0.4.6", [])
+ data.get("releases", {}).get("3.1.53", [])
+ data.get("releases", {}).get("0.51.0", [])],
key=lambda s:s[:s.rfind("-")]
)[:20])
except Exception as e:
print("ERROR:", e)
print("\n-- pinned package versions in src/requirements.txt --")
import re
text = open("src/requirements.txt", encoding="utf-8").read()
for line in text.splitlines():
line=line.strip()
if not line or line.startswith("#"):
continue
name=re.split(r'[<>=!~\[\];]', line,1)[0].lower().replace("_","-")
version=re.search(r'==[^\s,;]+', line)
print(f"{name}: {'pinned=' + version.group(0) if version else 'unpinned'}")
PY
echo
echo "== install lockfiles and usage =="
git ls-files | rg '(^|/)(requirements.*\.txt|Pipfile|pyproject\.toml|poetry\.lock|Pipfile\.lock)$|\.py$' || true
rg -n "GitPython|gitpython|from git|import git|uvicorn|fastapi" -S .Repository: salimfadhley/dockerized_python_playground
Length of output: 1337
🌐 Web query:
OSV vulnerabilities GitPython 3.1.9 critical GitPython PyPI
💡 Result:
GitPython version 3.1.9 is significantly outdated and critically vulnerable to multiple security flaws [1][2][3]. Because it lacks years of security patches, it is exposed to several high-severity and critical vulnerabilities, including Remote Code Execution (RCE) and arbitrary file manipulation [1][4][5]. Key security findings for GitPython 3.1.9 include: Remote Code Execution (RCE): Multiple vulnerabilities (e.g., CVE-2022-24439) exist where insufficient sanitization of input arguments allows attackers to inject malicious commands or remote URLs [5][6][3]. Command and Argument Injection: Later discoveries (such as GHSA-956x-8gvw-wg5v and CVE-2026-42215) identified that GitPython failed to properly block dangerous Git options across various methods like Repo.archive, Repo.ls_remote, and others, leading to further RCE vectors [1][4][7]. Arbitrary File Overwrite: Certain methods (e.g., Repo.iter_commits, Repo.blame) allow attackers to clobber arbitrary files on the host system by providing malicious revision strings [1][4]. Environment Variable Exposure: Vulnerabilities exist regarding the handling of remote URLs, where environment variables can be exfiltrated [8]. Given these risks, it is strongly recommended that you upgrade to the latest version of GitPython. Security patches have been released continuously to address these issues, with significant fixes occurring in versions 3.1.30, 3.1.47, 3.1.50, and 3.1.51 [1][2][7][3]. Users should always consult the official PyPI page for the most recent release and review the GitHub security advisories for a complete history of patched vulnerabilities [4][9][10].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-956x-8gvw-wg5v
- 2: https://osv.dev/vulnerability/PYSEC-2026-2161
- 3: https://osv.dev/vulnerability/CVE-2022-24439
- 4: GHSA-956x-8gvw-wg5v
- 5: GHSA-hcpj-qp55-gfph
- 6: https://nvd.nist.gov/vuln/detail/cve-2022-24439
- 7: https://nvd.nist.gov/vuln/detail/CVE-2026-42215
- 8: https://osv.dev/vulnerability/GHSA-rwj8-pgh3-r573
- 9: GHSA-2f96-g7mh-g2hx
- 10: GHSA-mv93-w799-cj2w
🌐 Web query:
OSV Uvicorn 0.4.6 high severity Uvicorn PyPI
💡 Result:
Uvicorn version 0.4.6 is affected by multiple high-severity vulnerabilities [1][2][3][4]. These security issues were addressed and fixed in Uvicorn version 0.11.7 [5][1][4]. Key vulnerabilities affecting version 0.4.6 include: 1. Log Injection (CVE-2020-7694 / GHSA-33c7-2mpw-hg34): The Uvicorn request logger is vulnerable to ANSI escape sequence injection [1][4]. By sending crafted requests with percent-encoded escape sequences, an attacker can manipulate logs to pollute access logs or interact with the terminal emulator displaying the logs [1][4]. This is classified as high severity [3][4]. 2. HTTP Response Splitting (GHSA-f97h-2pfx-f59f / PYSEC-2020-151): Versions prior to 0.11.7 are vulnerable to HTTP response splitting because CRLF sequences are not correctly escaped in HTTP header values [2][6]. This allows attackers to inject arbitrary headers or return arbitrary response bodies [2][6]. Users running Uvicorn 0.4.6 are strongly advised to upgrade to a patched version (0.11.7 or later) to mitigate these risks [5][1][4].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 2: https://osv.dev/vulnerability/PYSEC-2020-151
- 3: https://deps.dev/pypi/uvicorn/0.4.6
- 4: GHSA-33c7-2mpw-hg34
- 5: https://pypi.org/project/uvicorn/0.4.6/
- 6: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
Upgrade the vulnerable GitPython and Uvicorn dependencies before merging.
This requirements file relies on the current resolver’s default gitpython version and uvicorn==0.4.6, both of which are affected by critical/high-severity security issues. Pin patched, FastAPI-compatible versions—such as a current GitPython release (3.1.53) and Uvicorn 0.51.0—or remove GitPython if it is not needed at runtime.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` around lines 1 - 3, Update the dependency declarations
in requirements.txt to use patched, FastAPI-compatible versions by pinning
GitPython to 3.1.53 and Uvicorn to 0.51.0, or remove GitPython if it is not
required at runtime; leave the existing FastAPI dependency unchanged.
Source: Linters/SAST tools
|
Closing this in favor of #610 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.8.
Changelog
0.140.8
0.140.6
0.140.5
0.140.4
0.140.3
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1