Skip to content

Update fastapi to 0.141.0 #614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.141.0 #614

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.141.0
gitpython

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== requirements files =="
fd -a 'requirements.*txt' . || true

echo "== src/requirements.txt =="
cat -n src/requirements.txt || true

echo "== other GitPython occurrences =="
rg -n -i "gitpython|gitpython" -S . || true

echo "== Pipfile/lock/config references =="
fd -a 'Pipfile|poetry.lock|uv.lock|pyproject.toml|constraints.txt' . || true

Repository: salimfadhley/dockerized_python_playground

Length of output: 484

🌐 Web query:

OSV GHSA-2f96-g7mh-g2hx GitPython fixed version 3.1.51

💡 Result:

GitPython version 3.1.51 is the fixed version that addresses the security vulnerability GHSA-2f96-g7mh-g2hx [1][2]. This vulnerability involves a command injection flaw caused by the bypass of a previously implemented blocklist (from CVE-2026-42215) [3][4]. The issue arose because the initial fix did not account for Git's behavior of accepting unambiguous long-option prefix abbreviations [4][5]. Attackers could use abbreviated options (e.g., upload_p instead of upload-pack) to circumvent the security filter, allowing them to execute arbitrary OS commands when using GitPython methods like clone, fetch, or pull [3][6]. In version 3.1.51, the GitPython maintainers updated the check_unsafe_options logic to detect and reject these abbreviated long-option forms, effectively closing the bypass [7][8]. Users are strongly advised to upgrade to version 3.1.51 or higher to mitigate this risk [2][9].

Citations:

🌐 Web query:

PyPI gitpython current version 3.1.53

💡 Result:

As of July 29, 2026, version 3.1.53 is not the current version of GitPython on PyPI [1][2]. The latest version is 3.1.57 [1][2]. Version 3.1.53 was released on July 20, 2026 [3][4].

Citations:

Pin GitPython to a resolved safe version.

gitpython has no hash lock here, so installs can resolve different releases across environments. A pinned, hash-locked version should be chosen from a reproducible trusted source; 3.1.51+ is the fixed range for GHSA-2f96-g7mh-g2hx, but do not use an arbitrary “latest” tag in code.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 2, Update the GitPython dependency entry in
requirements.txt to a specific trusted version at or above 3.1.51 and include
its verified package hash, rather than leaving it unpinned or using a
latest-style constraint.

Source: Linters/SAST tools

uvicorn==0.4.6

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files =="
git ls-files | sed -n '1,120p'

echo "== requirements =="
if [ -f src/requirements.txt ]; then
  cat -n src/requirements.txt
else
  fd -a requirements.txt . | sed -n '1,50p'
fi

echo "== uvicorn pins/usages =="
rg -n "uvicorn|fastapi" -S . --glob '!venv/**' --glob '!dist/**' --glob '!build/**' || true

echo "== package metadata from PyPI =="
python3 - <<'PY'
import requests, json
for pkg in ["uvicorn","fastapi"]:
    r = requests.get(f"https://pypi.org/pypi/{pkg}/json", timeout=20)
    print(f"\n--- {pkg} -- status {r.status_code}")
    if r.status_code == 200:
        data = r.json()
        info = data.get("info", {})
        print("latest:", info.get("version"))
        versions = sorted(data.get("releases", {}).keys(), key=lambda x: tuple(map(int, x.split(".")[:3])), reverse=True)[:15]
        print("recent:", ", ".join(versions))
        if str(info.get("version")).startswith("0.141.0") or "0.141.0" in data.get("releases", {}):
            ver = "0.141.0"
        elif ver := sorted([v for v in data.get("releases", {}) if ver.startswith("0.141.")], reverse=True)[:1]:
            ver = ver[0]
        else:
            ver = info.get("version")
        rel = data["releases"].get(ver, [])
        print(f"version {ver} release files:")
        for f in rel[:20]:
            print("  ", f.get("filename"), f.get("python_version"))
PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 1095

🌐 Web query:

Uvicorn 0.4.6 February 2019 HTTP response splitting vulnerability fix 0.11.7

💡 Result:

Uvicorn version 0.11.7, released on July 28, 2020, included a security fix to address an HTTP response splitting vulnerability [1][2][3]. This vulnerability (tracked as CVE-2020-7695) affected all versions of Uvicorn prior to 0.11.7, including 0.4.6 [4][5][6]. The issue stemmed from Uvicorn's implementation of the HTTP protocol for the httptools parser, which failed to properly escape CRLF (carriage return and line feed) sequences in HTTP header values [4][6]. Attackers could exploit this by using crafted inputs to inject arbitrary HTTP headers or potentially return an arbitrary response body [4][7]. The fix in 0.11.7 specifically addressed this by preventing the sending of invalid HTTP header names and values [2][3]. Contrary to the February 2019 date suggested in the query, this vulnerability was publicly disclosed and patched in July 2020 [1][2][3].

Citations:

🌐 Web query:

PyPI fastapi 0.141.0 requires uvicorn or python dependency information

💡 Result:

In FastAPI versions 0.111.0 and later, including version 0.141.0, uvicorn is an optional dependency rather than a required one [1]. To include uvicorn when installing FastAPI, you must install the standard optional dependencies [2][3]. You can install FastAPI with these optional dependencies using the following commands: Using uv: uv add "fastapi[standard]" Using pip: pip install "fastapi[standard]" The standard set includes uvicorn[standard] (which provides the high-performance server components and uvloop) as well as other common dependencies like fastapi-cli, httpx, jinja2, python-multipart, and email-validator [2][4][3]. If you install FastAPI without specifying these optional dependencies (e.g., just pip install fastapi), uvicorn will not be installed automatically [1][3].

Citations:

Upgrade Uvicorn from the vulnerable 0.4.6 release.

Uvicorn <0.11.7 is affected by CVE-2020-7695, an HTTP response splitting issue. Since this repo pins FastAPI 0.141.0 while FastAPI does not require Uvicorn directly, keep a testable pinned Uvicorn version only after selecting a modern release compatible with the deployment path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 3, Update the pinned Uvicorn dependency in
requirements.txt from 0.4.6 to a modern release compatible with the repository’s
FastAPI 0.141.0 deployment path, ensuring the selected version is at least
0.11.7 and remains explicitly pinned for testing.

Source: Linters/SAST tools