Update fastapi to 0.135.2 - #558
Conversation
📝 WalkthroughWalkthroughThe fastapi dependency was updated from 0.6.4 to 0.135.2 in requirements.txt. This is a substantial version bump that introduces new features, improvements, and potentially breaking changes to the web framework. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/requirements.txt`:
- Around line 1-3: The uvicorn pin in requirements (uvicorn==0.4.6) is
incompatible with FastAPI 0.135.2 and contains known security issues; update the
uvicorn entry in requirements.txt to a secure, compatible release (e.g., replace
"uvicorn==0.4.6" with "uvicorn>=0.12.0,<1.0" or pin to a recent secure patch
like "uvicorn==0.18.3") so it satisfies FastAPI 0.135.2's requirement and
removes the vulnerable version.
| fastapi==0.135.2 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only verification: confirm current pins and inspect advisories/compatibility docs.
set -euo pipefail
echo "Current requirements:"
nl -ba src/requirements.txt
echo
echo "Check FastAPI release metadata:"
python - <<'PY'
import json, urllib.request
url="https://pypi.org/pypi/fastapi/0.135.2/json"
data=json.load(urllib.request.urlopen(url))
print("Requires-Python:", data["info"].get("requires_python"))
print("Requires-Dist sample:")
for dep in (data["info"].get("requires_dist") or [])[:20]:
print(" -", dep)
PY
echo
echo "Check latest Uvicorn version metadata:"
python - <<'PY'
import json, urllib.request
url="https://pypi.org/pypi/uvicorn/json"
data=json.load(urllib.request.urlopen(url))
print("Latest uvicorn:", data["info"]["version"])
print("Requires-Python:", data["info"].get("requires_python"))
PYRepository: salimfadhley/dockerized_python_playground
Length of output: 166
🌐 Web query:
For FastAPI 0.135.2, what Uvicorn versions are recommended/commonly used, and are there known security advisories affecting uvicorn 0.4.6?
💡 Result:
For FastAPI 0.135.2, the recommended and commonly used Uvicorn versions are uvicorn[standard] >=0.12.0, as specified in FastAPI's optional dependencies in pyproject.toml and PyPI pages for recent versions like 0.135.0 and 0.135.1. Examples in deployment guides and third-party setups (e.g., requirements.txt) commonly use recent versions like 0.30.0. Uvicorn 0.4.6 has known security vulnerabilities, including a medium-severity race condition (fixed in 0.12.3), log injection (fixed in 0.11.7), and HTTP response splitting (CVE-2020-7695, fixed in 0.11.7). These affect early versions before 0.11.7 and 0.12.3.
Citations:
- 1: https://pypi.org/project/fastapi/0.135.0/
- 2: https://pypi.org/project/fastapi/
- 3: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
- 4: https://www.zestminds.com/blog/fastapi-requirements-setup-guide-2025/
- 5: https://uvicorn.dev/release-notes
- 6: https://security.snyk.io/package/pip/uvicorn/0.5.0
- 7: https://security.snyk.io/package/pip/uvicorn
- 8: https://nvd.nist.gov/vuln/detail/CVE-2020-7695
- 9: Uvicorn 0.11.3 is vulnerable to CVE-2020-7695 and CVE-2020-7694 tiangolo/uvicorn-gunicorn-fastapi-docker#85
🏁 Script executed:
cat src/requirements.txtRepository: salimfadhley/dockerized_python_playground
Length of output: 126
Upgrade is incomplete: uvicorn==0.4.6 is both vulnerable and incompatible with FastAPI 0.135.2.
FastAPI 0.135.2 requires uvicorn>=0.12.0, but the current pin of uvicorn==0.4.6 violates this dependency and retains multiple known security vulnerabilities (CVE-2020-7695, log injection, race condition). Update Uvicorn in this PR to resolve both the incompatibility and security issues.
Suggested dependency update
fastapi==0.135.2
gitpython
-uvicorn==0.4.6
+uvicorn[standard]>=0.30,<1.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| fastapi==0.135.2 | |
| gitpython | |
| uvicorn==0.4.6 | |
| fastapi==0.135.2 | |
| gitpython | |
| uvicorn[standard]>=0.30,<1.0 |
🧰 Tools
🪛 OSV Scanner (2.3.3)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` around lines 1 - 3, The uvicorn pin in requirements
(uvicorn==0.4.6) is incompatible with FastAPI 0.135.2 and contains known
security issues; update the uvicorn entry in requirements.txt to a secure,
compatible release (e.g., replace "uvicorn==0.4.6" with "uvicorn>=0.12.0,<1.0"
or pin to a recent secure patch like "uvicorn==0.18.3") so it satisfies FastAPI
0.135.2's requirement and removes the vulnerable version.
|
Closing this in favor of #560 |
1 participant
This PR updates fastapi from 0.6.4 to 0.135.2.
Changelog
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1
0.128.0
0.127.1
0.127.0
0.126.0
0.125.0
0.124.4
0.124.3
0.124.2
0.124.1
0.124.0
0.123.10
0.123.9
0.123.8
0.123.7
0.123.6
0.123.5
0.123.4
0.123.3
0.123.2
0.123.1
0.123.0
0.122.1
0.122.0
0.121.3
0.121.2
0.121.1
0.121.0