Update fastapi to 0.141.0 - #614
Conversation
📝 WalkthroughWalkthrough
Changes依赖更新
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 2: Update the GitPython dependency entry in requirements.txt to a
specific trusted version at or above 3.1.51 and include its verified package
hash, rather than leaving it unpinned or using a latest-style constraint.
- Line 3: Update the pinned Uvicorn dependency in requirements.txt from 0.4.6 to
a modern release compatible with the repository’s FastAPI 0.141.0 deployment
path, ensuring the selected version is at least 0.11.7 and remains explicitly
pinned for testing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.141.0 | |||
| gitpython | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== requirements files =="
fd -a 'requirements.*txt' . || true
echo "== src/requirements.txt =="
cat -n src/requirements.txt || true
echo "== other GitPython occurrences =="
rg -n -i "gitpython|gitpython" -S . || true
echo "== Pipfile/lock/config references =="
fd -a 'Pipfile|poetry.lock|uv.lock|pyproject.toml|constraints.txt' . || trueRepository: salimfadhley/dockerized_python_playground
Length of output: 484
🌐 Web query:
OSV GHSA-2f96-g7mh-g2hx GitPython fixed version 3.1.51
💡 Result:
GitPython version 3.1.51 is the fixed version that addresses the security vulnerability GHSA-2f96-g7mh-g2hx [1][2]. This vulnerability involves a command injection flaw caused by the bypass of a previously implemented blocklist (from CVE-2026-42215) [3][4]. The issue arose because the initial fix did not account for Git's behavior of accepting unambiguous long-option prefix abbreviations [4][5]. Attackers could use abbreviated options (e.g., upload_p instead of upload-pack) to circumvent the security filter, allowing them to execute arbitrary OS commands when using GitPython methods like clone, fetch, or pull [3][6]. In version 3.1.51, the GitPython maintainers updated the check_unsafe_options logic to detect and reject these abbreviated long-option forms, effectively closing the bypass [7][8]. Users are strongly advised to upgrade to version 3.1.51 or higher to mitigate this risk [2][9].
Citations:
- 1: GHSA-2f96-g7mh-g2hx
- 2: https://cvereports.com/reports/GHSA-2F96-G7MH-G2HX
- 3: https://osv.dev/vulnerability/GHSA-2f96-g7mh-g2hx
- 4: GHSA-2f96-g7mh-g2hx
- 5: https://deps.dev/advisory/osv/GHSA-2f96-g7mh-g2hx
- 6: GHSA-2f96-g7mh-g2hx
- 7: fix: block unsafe long-option prefixes (GHSA-2f96-g7mh-g2hx) gitpython-developers/GitPython#2161
- 8: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
- 9: https://www.tenable.com/plugins/container-security/445070
🌐 Web query:
PyPI gitpython current version 3.1.53
💡 Result:
As of July 29, 2026, version 3.1.53 is not the current version of GitPython on PyPI [1][2]. The latest version is 3.1.57 [1][2]. Version 3.1.53 was released on July 20, 2026 [3][4].
Citations:
- 1: https://github.com/gitpython-developers/GitPython/releases
- 2: https://gitpython.readthedocs.io/en/stable/intro.html
- 3: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53
- 4: https://newreleases.io/project/pypi/GitPython/release/3.1.53
Pin GitPython to a resolved safe version.
gitpython has no hash lock here, so installs can resolve different releases across environments. A pinned, hash-locked version should be chosen from a reproducible trusted source; 3.1.51+ is the fixed range for GHSA-2f96-g7mh-g2hx, but do not use an arbitrary “latest” tag in code.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 2, Update the GitPython dependency entry in
requirements.txt to a specific trusted version at or above 3.1.51 and include
its verified package hash, rather than leaving it unpinned or using a
latest-style constraint.
Source: Linters/SAST tools
| fastapi==0.6.4 | ||
| fastapi==0.141.0 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | sed -n '1,120p'
echo "== requirements =="
if [ -f src/requirements.txt ]; then
cat -n src/requirements.txt
else
fd -a requirements.txt . | sed -n '1,50p'
fi
echo "== uvicorn pins/usages =="
rg -n "uvicorn|fastapi" -S . --glob '!venv/**' --glob '!dist/**' --glob '!build/**' || true
echo "== package metadata from PyPI =="
python3 - <<'PY'
import requests, json
for pkg in ["uvicorn","fastapi"]:
r = requests.get(f"https://pypi.org/pypi/{pkg}/json", timeout=20)
print(f"\n--- {pkg} -- status {r.status_code}")
if r.status_code == 200:
data = r.json()
info = data.get("info", {})
print("latest:", info.get("version"))
versions = sorted(data.get("releases", {}).keys(), key=lambda x: tuple(map(int, x.split(".")[:3])), reverse=True)[:15]
print("recent:", ", ".join(versions))
if str(info.get("version")).startswith("0.141.0") or "0.141.0" in data.get("releases", {}):
ver = "0.141.0"
elif ver := sorted([v for v in data.get("releases", {}) if ver.startswith("0.141.")], reverse=True)[:1]:
ver = ver[0]
else:
ver = info.get("version")
rel = data["releases"].get(ver, [])
print(f"version {ver} release files:")
for f in rel[:20]:
print(" ", f.get("filename"), f.get("python_version"))
PYRepository: salimfadhley/dockerized_python_playground
Length of output: 1095
🌐 Web query:
Uvicorn 0.4.6 February 2019 HTTP response splitting vulnerability fix 0.11.7
💡 Result:
Uvicorn version 0.11.7, released on July 28, 2020, included a security fix to address an HTTP response splitting vulnerability [1][2][3]. This vulnerability (tracked as CVE-2020-7695) affected all versions of Uvicorn prior to 0.11.7, including 0.4.6 [4][5][6]. The issue stemmed from Uvicorn's implementation of the HTTP protocol for the httptools parser, which failed to properly escape CRLF (carriage return and line feed) sequences in HTTP header values [4][6]. Attackers could exploit this by using crafted inputs to inject arbitrary HTTP headers or potentially return an arbitrary response body [4][7]. The fix in 0.11.7 specifically addressed this by preventing the sending of invalid HTTP header names and values [2][3]. Contrary to the February 2019 date suggested in the query, this vulnerability was publicly disclosed and patched in July 2020 [1][2][3].
Citations:
- 1: Security Notice & Bug Bounty - HTTP Response Splitting - huntr.dev Kludex/uvicorn#728
- 2: https://uvicorn.dev/release-notes/
- 3: Kludex/uvicorn@8f35b6d
- 4: https://osv.dev/vulnerability/CVE-2020-7695
- 5: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 6: https://security.snyk.io/vuln/SNYK-PYTHON-UVICORN-570471
- 7: GHSA-f97h-2pfx-f59f
🌐 Web query:
PyPI fastapi 0.141.0 requires uvicorn or python dependency information
💡 Result:
In FastAPI versions 0.111.0 and later, including version 0.141.0, uvicorn is an optional dependency rather than a required one [1]. To include uvicorn when installing FastAPI, you must install the standard optional dependencies [2][3]. You can install FastAPI with these optional dependencies using the following commands: Using uv: uv add "fastapi[standard]" Using pip: pip install "fastapi[standard]" The standard set includes uvicorn[standard] (which provides the high-performance server components and uvloop) as well as other common dependencies like fastapi-cli, httpx, jinja2, python-multipart, and email-validator [2][4][3]. If you install FastAPI without specifying these optional dependencies (e.g., just pip install fastapi), uvicorn will not be installed automatically [1][3].
Citations:
- 1: About the changelog for v 0.112.0 - uvicorn is not installed by fastapi==0.110.3? fastapi/fastapi#14719
- 2: https://pypi.org/project/fastapi/
- 3: https://github.com/fastapi/fastapi
- 4: https://github.com/fastapi/fastapi/blob/0.139.2/pyproject.toml
Upgrade Uvicorn from the vulnerable 0.4.6 release.
Uvicorn <0.11.7 is affected by CVE-2020-7695, an HTTP response splitting issue. Since this repo pins FastAPI 0.141.0 while FastAPI does not require Uvicorn directly, keep a testable pinned Uvicorn version only after selecting a modern release compatible with the deployment path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 3, Update the pinned Uvicorn dependency in
requirements.txt from 0.4.6 to a modern release compatible with the repository’s
FastAPI 0.141.0 deployment path, ensuring the selected version is at least
0.11.7 and remains explicitly pinned for testing.
Source: Linters/SAST tools
|
Closing this in favor of #615 |
1 participant
This PR updates fastapi from 0.6.4 to 0.141.0.
Changelog
0.141.0
0.140.13
0.140.12
0.140.11
0.140.10
0.140.9
0.140.8
0.140.6
0.140.5
0.140.4
0.140.3
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1