Skip to content

Update fastapi to 0.140.12 #611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.140.12 #611

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.140.12

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== requirements files =="
git ls-files | rg '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)Pipfile$|(^|/)poetry\.lock$|(^|/)uv\.lock$' || true

echo
echo "== src/requirements.txt =="
if [ -f src/requirements.txt ]; then
  cat -n src/requirements.txt
fi

echo
echo "== uvicorn/fastapi mentions =="
rg -n --hidden --glob '!*__pycache__*' 'uvicorn|fastapi' . || true

echo
echo "== dependency lock snippets =="
for f in pyproject.toml poetry.lock Pipfile.lock uv.lock; do
  [ -f "$f" ] || continue
  echo "--- $f ---"
  rg -n -C 2 'name ?=|uvicorn|fastapi' "$f" || true
done

Repository: salimfadhley/dockerized_python_playground

Length of output: 489

🌐 Web query:

UVSec PYSEC-2020-150 Uvicorn 0.4.6 log injection HTTP response splitting affected fixed version

💡 Result:

The vulnerability identified as PYSEC-2020-150 (also tracked as CVE-2020-7694 and GHSA-33c7-2mpw-hg34) is a log injection vulnerability affecting Uvicorn [1][2][3]. This vulnerability exists because the Uvicorn request logger processes URLs with urllib.parse.unquote before logging them, which converts percent-encoded characters into their single-character equivalents [1][4]. Attackers can exploit this by sending crafted URLs containing ANSI escape sequences or characters that mimic log entries, allowing them to pollute logs or potentially interact with the terminal emulator displaying the logs [1][2][4]. Version 0.4.6 of Uvicorn is affected by this vulnerability [1][5]. The issue was addressed and fixed in Uvicorn version 0.11.7 [2][6][4]. Users running version 0.4.6 or any version earlier than 0.11.7 are advised to upgrade to 0.11.7 or higher to mitigate this risk [4].

Citations:

Upgrade the vulnerable Uvicorn pin before merging.

uvicorn==0.4.6 in src/requirements.txt is affected by log-injection and HTTP-response-splitting advisory PYSEC-2020-150; the issue is fixed starting with 0.11.7. Upgrade it to a secure, FastAPI-compatible release and regenerate the dependency scan.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, Update the Uvicorn dependency pin in the
requirements configuration to version 0.11.7 or newer, selecting a release
compatible with the existing FastAPI pin, then regenerate the dependency scan to
confirm the vulnerability is resolved.

Source: Linters/SAST tools

gitpython
uvicorn==0.4.6