Update fastapi to 0.140.9 - #610
Conversation
📝 WalkthroughWalkthroughFastAPI is upgraded from version 0.6.4 to 0.140.9 in ChangesFastAPI dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the dependency declarations in requirements.txt to remove or
upgrade the vulnerable Uvicorn and GitPython entries; if retained, pin GitPython
to a non-vulnerable version and ensure Uvicorn is pinned to a non-vulnerable
version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.140.9 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files="$(fd -a -t f)"
printf '%s\n' "$files" | rg '(requirements|constraints|lock|pyproject\.toml|setup\.py|Pipfile)' |
xargs -r rg -n -i 'gitpython|uvicorn|fastapi'Repository: salimfadhley/dockerized_python_playground
Length of output: 347
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- src/requirements.txt ---\n'
cat -n src/requirements.txt
printf '\n--- resolve direct/indirect FastAPI/Uvicorn/GitPython pins from pip metadata (no install) ---\n'
python3 - <<'PY'
from urllib.request import urlopen
from urllib.error import HTTPError
for name in ["fastapi", "uvicorn", "gitpython"]:
url = f"https://pypi.org/pypi/{name}/json"
print(f"\n{name}: {url}")
try:
data = urlopen(url, timeout=20).read()
except HTTPError as e:
print(f"ERROR {e.code} {e}")
continue
import json
info = json.loads(data)
print("latest:", info.get("info", {}).get("version"))
versions = sorted(info.get("releases", {}).keys(), key=lambda v: [int(x) if re.isdigit(x) else 0 for x in v.split(".")], reverse=True)[:5]
import re
print("recent:", versions)
PYRepository: salimfadhley/dockerized_python_playground
Length of output: 270
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- src/requirements.txt ---'
cat -n 'src/requirements.txt'
echo
echo '--- dependency metadata from PyPI ---'
python3 - <<'PY'
import re,json
from urllib.request import urlopen
from urllib.error import HTTPError
for name in ["fastapi", "uvicorn", "gitpython"]:
url = f"https://pypi.org/pypi/{name}/json"
print(f"\n{name}: {url}")
try:
data = urlopen(url, timeout=20).read()
except HTTPError as e:
print(f"ERROR {e.code} {e}")
continue
info = json.loads(data)
print("latest:", info.get("info", {}).get("version"))
versions = sorted(info.get("releases", {}).keys(),
key=lambda v: [int(x) if re.fullmatch(r"\d+", x) else 0
for x in v.split(".")],
reverse=True)[:5]
print("recent:",versions)
PYRepository: salimfadhley/dockerized_python_playground
Length of output: 2641
🌐 Web query:
PyPI fastapi 0.140.9 uvicorn dependency requirements
💡 Result:
For FastAPI version 0.140.9, the dependency requirement for Uvicorn is defined as uvicorn[standard] >=0.12.0 [1][2]. This dependency is included as part of the optional standard (and all) extra, meaning it is not installed by default if you perform a standard pip install fastapi [3][4]. To include Uvicorn when installing FastAPI, you should use the standard extra: pip install "fastapi[standard]" The uvicorn[standard] requirement includes Uvicorn along with additional dependencies (such as uvloop) needed for high-performance production serving [3][4]. Because FastAPI's dependency structure for these optional extras has remained consistent across the 0.140.x release series [1][2], this requirement applies to version 0.140.9 [5].
Citations:
- 1: https://github.com/fastapi/fastapi/blob/0.139.2/pyproject.toml
- 2: https://github.com/fastapi/fastapi/blob/e94028ab/pyproject.toml
- 3: https://pypi.org/project/fastapi/0.140.0/
- 4: https://pypi.org/project/fastapi/
- 5: https://fastapi.tiangolo.com/release-notes/
Pin and remediate the vulnerable GitPython and Uvicorn entries.
src/requirements.txt directly pins uvicorn==0.4.6 and unpins gitpython, so the scanner-reported vulnerable dependencies are present in the resolved dependency graph. Upgrade them to non-vulnerable versions or remove them if they are not needed. Also pin gitpython when upgrading.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the dependency declarations in
requirements.txt to remove or upgrade the vulnerable Uvicorn and GitPython
entries; if retained, pin GitPython to a non-vulnerable version and ensure
Uvicorn is pinned to a non-vulnerable version.
Source: Linters/SAST tools
|
Closing this in favor of #611 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.9.
Changelog
0.140.9
0.140.8
0.140.6
0.140.5
0.140.4
0.140.3
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1