Update fastapi to 0.141.1 - #615
Conversation
📝 WalkthroughWalkthroughFastAPI is upgraded in ChangesFastAPI dependency upgrade
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: Update the pinned Uvicorn dependency in src/requirements.txt from
0.4.6 to a patched release compatible with Python 3.9, then validate the
application startup path using that version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.141.1 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== requirements files =="
git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$' || true
echo
echo "== uvicorn references =="
rg -n "uvicorn" -S .
echo
echo "== requirements content =="
for f in $(git ls-files | grep -E '(^|/)requirements.*\.txt$|(^|/)pyproject\.toml$|(^|/)setup\.py$|(^|/)setup\.cfg$'); do
echo "--- $f"
sed -n '1,220p' "$f"
done
echo
echo "== repository python/runtime hints =="
if [ -f setup.cfg ]; then cat setup.cfg; fi
if [ -f pyrightconfig.json ]; then cat pyrightconfig.json; fi
if [ -f .python-version ]; then cat .python-version; fi
python3 -c "import sys; print(sys.version)"Repository: salimfadhley/dockerized_python_playground
Length of output: 1701
🌐 Web query:
OSV uvicorn 0.4.6 HTTP response splitting log injection vulnerabilities
💡 Result:
Uvicorn version 0.4.6 is affected by two known security vulnerabilities: HTTP response splitting (CVE-2020-7695) and log injection (CVE-2020-7694) [1][2]. HTTP Response Splitting (CVE-2020-7695) Uvicorn versions before 0.11.7 are vulnerable to HTTP response splitting [3][4][5]. The issue stems from the improper handling of CRLF (carriage return and line feed) sequences in HTTP headers [6][7]. Because these sequences are not properly escaped, an attacker can provide crafted input when constructing headers to inject arbitrary headers or even return an arbitrary response body [3][5][6]. This vulnerability is classified with a high severity rating [7]. Log Injection (CVE-2020-7694) Uvicorn is also affected by a log injection vulnerability [8][9]. The request logger is susceptible to ANSI escape sequence injection [8][10]. When an attacker sends a request with a URL containing percent-encoded escape sequences, Uvicorn logs the URL after it has been decoded, which converts these sequences into characters that can have special meanings in terminal emulators [8][9]. This allows attackers to pollute access logs and potentially interact with the terminal emulator displaying those logs [8][10]. Mitigation Both vulnerabilities are fixed in Uvicorn version 0.11.7 and later [3][4][8]. Users of version 0.4.6 are advised to upgrade to a version at or above 0.11.7 to remediate these security risks [7][8]. If an immediate upgrade is not feasible, potential workarounds for the log injection issue include disabling the request logger or modifying the logging configuration [7].
Citations:
- 1: https://pypi.org/project/uvicorn/0.4.6/
- 2: https://www.versioneye.com/Python/uvicorn/0.4.6?sort=released
- 3: https://osv.dev/vulnerability/PYSEC-2020-151
- 4: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
- 5: https://osv.dev/vulnerability/CVE-2020-7695
- 6: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 7: https://vulert.com/vuln-db/pypi-uvicorn-14569
- 8: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 9: GHSA-33c7-2mpw-hg34
- 10: https://nvd.nist.gov/vuln/detail/cve-2020-7694
Upgrade the pinned Uvicorn dependency.
uvicorn==0.4.6 is still in src/requirements.txt and is affected by CVE-2020-7695 (HTTP response splitting) and CVE-2020-7694 (log injection). Upgrade to a patched release compatible with Python 3.9 and validate the startup path.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2162)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2026-2163)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: command injection via unguarded Git options in Repo.archive(), git.ls_remote(), and arbitrary file overwrite via Repo.iter_commits() / Repo.blame()
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, Update the pinned Uvicorn dependency in
src/requirements.txt from 0.4.6 to a patched release compatible with Python 3.9,
then validate the application startup path using that version.
Source: Linters/SAST tools
1 participant
This PR updates fastapi from 0.6.4 to 0.141.1.
Changelog
0.141.1
0.141.0
0.140.13
0.140.12
0.140.11
0.140.10
0.140.9
0.140.8
0.140.6
0.140.5
0.140.4
0.140.3
0.140.2
0.140.1
0.140.0
0.139.2
0.139.1
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2