Update fastapi to 0.140.12 - #611
Conversation
📝 WalkthroughWalkthroughUpdates the FastAPI dependency in ChangesFastAPI dependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the Uvicorn dependency pin in the requirements configuration to
version 0.11.7 or newer, selecting a release compatible with the existing
FastAPI pin, then regenerate the dependency scan to confirm the vulnerability is
resolved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.140.12 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== requirements files =="
git ls-files | rg '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)Pipfile$|(^|/)poetry\.lock$|(^|/)uv\.lock$' || true
echo
echo "== src/requirements.txt =="
if [ -f src/requirements.txt ]; then
cat -n src/requirements.txt
fi
echo
echo "== uvicorn/fastapi mentions =="
rg -n --hidden --glob '!*__pycache__*' 'uvicorn|fastapi' . || true
echo
echo "== dependency lock snippets =="
for f in pyproject.toml poetry.lock Pipfile.lock uv.lock; do
[ -f "$f" ] || continue
echo "--- $f ---"
rg -n -C 2 'name ?=|uvicorn|fastapi' "$f" || true
doneRepository: salimfadhley/dockerized_python_playground
Length of output: 489
🌐 Web query:
UVSec PYSEC-2020-150 Uvicorn 0.4.6 log injection HTTP response splitting affected fixed version
💡 Result:
The vulnerability identified as PYSEC-2020-150 (also tracked as CVE-2020-7694 and GHSA-33c7-2mpw-hg34) is a log injection vulnerability affecting Uvicorn [1][2][3]. This vulnerability exists because the Uvicorn request logger processes URLs with urllib.parse.unquote before logging them, which converts percent-encoded characters into their single-character equivalents [1][4]. Attackers can exploit this by sending crafted URLs containing ANSI escape sequences or characters that mimic log entries, allowing them to pollute logs or potentially interact with the terminal emulator displaying the logs [1][2][4]. Version 0.4.6 of Uvicorn is affected by this vulnerability [1][5]. The issue was addressed and fixed in Uvicorn version 0.11.7 [2][6][4]. Users running version 0.4.6 or any version earlier than 0.11.7 are advised to upgrade to 0.11.7 or higher to mitigate this risk [4].
Citations:
- 1: https://osv.dev/vulnerability/PYSEC-2020-150
- 2: GHSA-33c7-2mpw-hg34
- 3: https://nvd.nist.gov/vuln/detail/cve-2020-7694
- 4: https://security.snyk.io/vuln/SNYK-PYTHON-UVICORN-575560
- 5: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 6: https://deps.dev/advisory/osv/PYSEC-2020-150
Upgrade the vulnerable Uvicorn pin before merging.
uvicorn==0.4.6 in src/requirements.txt is affected by log-injection and HTTP-response-splitting advisory PYSEC-2020-150; the issue is fixed starting with 0.11.7. Upgrade it to a secure, FastAPI-compatible release and regenerate the dependency scan.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the Uvicorn dependency pin in the
requirements configuration to version 0.11.7 or newer, selecting a release
compatible with the existing FastAPI pin, then regenerate the dependency scan to
confirm the vulnerability is resolved.
Source: Linters/SAST tools
|
Closing this in favor of #612 |
1 participant
This PR updates fastapi from 0.6.4 to 0.140.12.
Changelog
0.140.12
0.140.11
0.140.10
0.140.9
0.140.8
0.140.6
0.140.5
0.140.4
0.140.3
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1