Skip to content

Update fastapi to 0.135.2 #558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.135.2 #558

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.135.2
gitpython
uvicorn==0.4.6
Comment on lines +1 to 3

@coderabbitai coderabbitai Bot Mar 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read-only verification: confirm current pins and inspect advisories/compatibility docs.
set -euo pipefail

echo "Current requirements:"
nl -ba src/requirements.txt

echo
echo "Check FastAPI release metadata:"
python - <<'PY'
import json, urllib.request
url="https://pypi.org/pypi/fastapi/0.135.2/json"
data=json.load(urllib.request.urlopen(url))
print("Requires-Python:", data["info"].get("requires_python"))
print("Requires-Dist sample:")
for dep in (data["info"].get("requires_dist") or [])[:20]:
    print(" -", dep)
PY

echo
echo "Check latest Uvicorn version metadata:"
python - <<'PY'
import json, urllib.request
url="https://pypi.org/pypi/uvicorn/json"
data=json.load(urllib.request.urlopen(url))
print("Latest uvicorn:", data["info"]["version"])
print("Requires-Python:", data["info"].get("requires_python"))
PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 166

🌐 Web query:

For FastAPI 0.135.2, what Uvicorn versions are recommended/commonly used, and are there known security advisories affecting uvicorn 0.4.6?

💡 Result:

For FastAPI 0.135.2, the recommended and commonly used Uvicorn versions are uvicorn[standard] >=0.12.0, as specified in FastAPI's optional dependencies in pyproject.toml and PyPI pages for recent versions like 0.135.0 and 0.135.1. Examples in deployment guides and third-party setups (e.g., requirements.txt) commonly use recent versions like 0.30.0. Uvicorn 0.4.6 has known security vulnerabilities, including a medium-severity race condition (fixed in 0.12.3), log injection (fixed in 0.11.7), and HTTP response splitting (CVE-2020-7695, fixed in 0.11.7). These affect early versions before 0.11.7 and 0.12.3.

Citations:

🏁 Script executed:

cat src/requirements.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 126

Upgrade is incomplete: uvicorn==0.4.6 is both vulnerable and incompatible with FastAPI 0.135.2.

FastAPI 0.135.2 requires uvicorn>=0.12.0, but the current pin of uvicorn==0.4.6 violates this dependency and retains multiple known security vulnerabilities (CVE-2020-7695, log injection, race condition). Update Uvicorn in this PR to resolve both the incompatibility and security issues.

Suggested dependency update 
 fastapi==0.135.2
 gitpython
-uvicorn==0.4.6
+uvicorn[standard]>=0.30,<1.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
fastapi==0.135.2
gitpython
uvicorn==0.4.6
fastapi==0.135.2
gitpython
uvicorn[standard]>=0.30,<1.0
🧰 Tools
🪛 OSV Scanner (2.3.3)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/requirements.txt` around lines 1 - 3, The uvicorn pin in requirements
(uvicorn==0.4.6) is incompatible with FastAPI 0.135.2 and contains known
security issues; update the uvicorn entry in requirements.txt to a secure,
compatible release (e.g., replace "uvicorn==0.4.6" with "uvicorn>=0.12.0,<1.0"
or pin to a recent secure patch like "uvicorn==0.18.3") so it satisfies FastAPI
0.135.2's requirement and removes the vulnerable version.