Skip to content

Update fastapi to 0.140.9 #610

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.140.9 #610

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.140.9

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

files="$(fd -a -t f)"
printf '%s\n' "$files" | rg '(requirements|constraints|lock|pyproject\.toml|setup\.py|Pipfile)' |
  xargs -r rg -n -i 'gitpython|uvicorn|fastapi'

Repository: salimfadhley/dockerized_python_playground

Length of output: 347

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '--- src/requirements.txt ---\n'
cat -n src/requirements.txt

printf '\n--- resolve direct/indirect FastAPI/Uvicorn/GitPython pins from pip metadata (no install) ---\n'
python3 - <<'PY'
from urllib.request import urlopen
from urllib.error import HTTPError

for name in ["fastapi", "uvicorn", "gitpython"]:
    url = f"https://pypi.org/pypi/{name}/json"
    print(f"\n{name}: {url}")
    try:
        data = urlopen(url, timeout=20).read()
    except HTTPError as e:
        print(f"ERROR {e.code} {e}")
        continue

    import json
    info = json.loads(data)
    print("latest:", info.get("info", {}).get("version"))
    versions = sorted(info.get("releases", {}).keys(), key=lambda v: [int(x) if re.isdigit(x) else 0 for x in v.split(".")], reverse=True)[:5]
    import re
    print("recent:", versions)
PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 270

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo '--- src/requirements.txt ---'
cat -n 'src/requirements.txt'

echo
echo '--- dependency metadata from PyPI ---'
python3 - <<'PY'
import re,json
from urllib.request import urlopen
from urllib.error import HTTPError

for name in ["fastapi", "uvicorn", "gitpython"]:
    url = f"https://pypi.org/pypi/{name}/json"
    print(f"\n{name}: {url}")
    try:
        data = urlopen(url, timeout=20).read()
    except HTTPError as e:
        print(f"ERROR {e.code} {e}")
        continue

    info = json.loads(data)
    print("latest:", info.get("info", {}).get("version"))
    versions = sorted(info.get("releases", {}).keys(),
                      key=lambda v: [int(x) if re.fullmatch(r"\d+", x) else 0
                                     for x in v.split(".")],
                      reverse=True)[:5]
    print("recent:",versions)

PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 2641

🌐 Web query:

PyPI fastapi 0.140.9 uvicorn dependency requirements

💡 Result:

For FastAPI version 0.140.9, the dependency requirement for Uvicorn is defined as uvicorn[standard] >=0.12.0 [1][2]. This dependency is included as part of the optional standard (and all) extra, meaning it is not installed by default if you perform a standard pip install fastapi [3][4]. To include Uvicorn when installing FastAPI, you should use the standard extra: pip install "fastapi[standard]" The uvicorn[standard] requirement includes Uvicorn along with additional dependencies (such as uvloop) needed for high-performance production serving [3][4]. Because FastAPI's dependency structure for these optional extras has remained consistent across the 0.140.x release series [1][2], this requirement applies to version 0.140.9 [5].

Citations:

Pin and remediate the vulnerable GitPython and Uvicorn entries.

src/requirements.txt directly pins uvicorn==0.4.6 and unpins gitpython, so the scanner-reported vulnerable dependencies are present in the resolved dependency graph. Upgrade them to non-vulnerable versions or remove them if they are not needed. Also pin gitpython when upgrading.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2162)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2026-2163)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

(GHSA-2f96-g7mh-g2hx)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

(GHSA-3rp5-jjmw-4wv2)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

(GHSA-6p8h-3wgx-97gf)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

(GHSA-94p4-4cq8-9g67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()

(GHSA-956x-8gvw-wg5v)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

(GHSA-fjr4-x663-mwxc)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

(GHSA-r9mr-m37c-5fr3)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

(GHSA-rwj8-pgh3-r573)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the dependency declarations in
requirements.txt to remove or upgrade the vulnerable Uvicorn and GitPython
entries; if retained, pin GitPython to a non-vulnerable version and ensure
Uvicorn is pinned to a non-vulnerable version.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6