Update fastapi to 0.135.3 - #560
Conversation
📝 WalkthroughWalkthroughThe FastAPI dependency version in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/requirements.txt`:
- Around line 2-3: Pin and upgrade the two packages in requirements.txt: replace
the unpinned "gitpython" with a specific, patched version (e.g.,
gitpython==3.1.31 or newer) and update "uvicorn==0.4.6" to a modern secure
release (e.g., uvicorn==0.22.0 or the latest stable). After updating the package
versions, regenerate your dependency lock (pip-compile / poetry lock / pip
freeze) and run your test matrix to ensure compatibility with your FastAPI
version; verify imports and any uvicorn or GitPython API calls used in your
codebase still work (search for usages of GitPython/Git and uvicorn.run) and
adjust call signatures if needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== PyPI latest versions =="
for pkg in fastapi gitpython uvicorn; do
echo "--- $pkg ---"
curl -s "https://pypi.org/pypi/${pkg}/json" | jq -r '.info.version'
done
echo
echo "== OSV check for currently declared versions =="
cat > /tmp/osv-query.json <<'JSON'
{
"queries": [
{"package": {"name": "uvicorn", "ecosystem": "PyPI"}, "version": "0.4.6"},
{"package": {"name": "gitpython", "ecosystem": "PyPI"}, "version": "3.1.9"}
]
}
JSON
curl -s https://api.osv.dev/v1/querybatch \
-H 'Content-Type: application/json' \
--data `@/tmp/osv-query.json` | jq .Repository: salimfadhley/dockerized_python_playground
Length of output: 1861
🏁 Script executed:
cat src/requirements.txtRepository: salimfadhley/dockerized_python_playground
Length of output: 126
🏁 Script executed:
# Check if FastAPI is mentioned anywhere in requirements or dependencies
rg -i "fastapi" --type txtRepository: salimfadhley/dockerized_python_playground
Length of output: 122
Pin and upgrade gitpython and uvicorn before merging.
gitpython is unpinned and uvicorn==0.4.6 is from 2020—both have known vulnerabilities. The OSV database flags uvicorn==0.4.6 with 4 CVEs and unpinned gitpython with multiple CVEs. Modern FastAPI (0.135.3) with such old dependencies creates compatibility and security risks. Pin both to patched versions and re-lock dependencies.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` around lines 2 - 3, Pin and upgrade the two packages in
requirements.txt: replace the unpinned "gitpython" with a specific, patched
version (e.g., gitpython==3.1.31 or newer) and update "uvicorn==0.4.6" to a
modern secure release (e.g., uvicorn==0.22.0 or the latest stable). After
updating the package versions, regenerate your dependency lock (pip-compile /
poetry lock / pip freeze) and run your test matrix to ensure compatibility with
your FastAPI version; verify imports and any uvicorn or GitPython API calls used
in your codebase still work (search for usages of GitPython/Git and uvicorn.run)
and adjust call signatures if needed.
|
Closing this in favor of #565 |
1 participant
This PR updates fastapi from 0.6.4 to 0.135.3.
Changelog
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1
0.128.0
0.127.1
0.127.0
0.126.0
0.125.0
0.124.4
0.124.3
0.124.2
0.124.1
0.124.0
0.123.10
0.123.9
0.123.8
0.123.7
0.123.6
0.123.5
0.123.4
0.123.3
0.123.2
0.123.1
0.123.0
0.122.1
0.122.0
0.121.3
0.121.2
0.121.1