Skip to content

Update fastapi to 0.135.3 #560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.135.3 #560

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.135.3
gitpython
uvicorn==0.4.6
Comment on lines 2 to 3

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== PyPI latest versions =="
for pkg in fastapi gitpython uvicorn; do
  echo "--- $pkg ---"
  curl -s "https://pypi.org/pypi/${pkg}/json" | jq -r '.info.version'
done

echo
echo "== OSV check for currently declared versions =="
cat > /tmp/osv-query.json <<'JSON'
{
  "queries": [
    {"package": {"name": "uvicorn", "ecosystem": "PyPI"}, "version": "0.4.6"},
    {"package": {"name": "gitpython", "ecosystem": "PyPI"}, "version": "3.1.9"}
  ]
}
JSON

curl -s https://api.osv.dev/v1/querybatch \
  -H 'Content-Type: application/json' \
  --data `@/tmp/osv-query.json` | jq .

Repository: salimfadhley/dockerized_python_playground

Length of output: 1861

🏁 Script executed:

cat src/requirements.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 126

🏁 Script executed:

# Check if FastAPI is mentioned anywhere in requirements or dependencies
rg -i "fastapi" --type txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 122

Pin and upgrade gitpython and uvicorn before merging.

gitpython is unpinned and uvicorn==0.4.6 is from 2020—both have known vulnerabilities. The OSV database flags uvicorn==0.4.6 with 4 CVEs and unpinned gitpython with multiple CVEs. Modern FastAPI (0.135.3) with such old dependencies creates compatibility and security risks. Pin both to patched versions and re-lock dependencies.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/requirements.txt` around lines 2 - 3, Pin and upgrade the two packages in
requirements.txt: replace the unpinned "gitpython" with a specific, patched
version (e.g., gitpython==3.1.31 or newer) and update "uvicorn==0.4.6" to a
modern secure release (e.g., uvicorn==0.22.0 or the latest stable). After
updating the package versions, regenerate your dependency lock (pip-compile /
poetry lock / pip freeze) and run your test matrix to ensure compatibility with
your FastAPI version; verify imports and any uvicorn or GitPython API calls used
in your codebase still work (search for usages of GitPython/Git and uvicorn.run)
and adjust call signatures if needed.