Update fastapi to 0.136.0 - #565
Conversation
📝 WalkthroughWalkthroughThe pull request updates the pinned Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/requirements.txt`:
- Line 3: Replace the deprecated pinned uvicorn==0.4.6 in requirements.txt with
a modern, secure release (for example update to uvicorn>=0.23.0 or pin to a
0.23.x release) to remove the log injection/HTTP response splitting
vulnerabilities and satisfy FastAPI's minimum uvicorn requirement; after
changing the uvicorn entry in requirements.txt, re-run dependency installation
and the test suite (and any security scanner) to ensure compatibility with
FastAPI and no regressions.
- Line 2: Pin the gitpython dependency in requirements.txt to a patched release
to avoid installing vulnerable versions; replace the bare "gitpython" entry with
a constrained spec such as "gitpython>=3.1.41,<4.0" (or an exact patched version
like "gitpython==3.1.41") and then regenerate any lock files or reinstall
dependencies to verify no regressions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.136.0 | |||
| gitpython | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check gitpython security advisories and find patched version
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: PIP, package: "gitpython") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: salimfadhley/dockerized_python_playground
Length of output: 1360
Pin gitpython to a patched version to address critical security vulnerabilities.
The unpinned dependency allows installation of vulnerable versions with critical remote code execution flaws (patched in 3.1.32, 3.1.30), blind local file inclusion (patched in 3.1.37), and Windows search path execution vulnerabilities (patched in 3.1.33, 3.1.41).
-gitpython
+gitpython>=3.1.43📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| gitpython | |
| gitpython>=3.1.43 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` at line 2, Pin the gitpython dependency in
requirements.txt to a patched release to avoid installing vulnerable versions;
replace the bare "gitpython" entry with a constrained spec such as
"gitpython>=3.1.41,<4.0" (or an exact patched version like "gitpython==3.1.41")
and then regenerate any lock files or reinstall dependencies to verify no
regressions.
| fastapi==0.6.4 | ||
| fastapi==0.136.0 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check FastAPI 0.136.0 uvicorn dependency requirements and security advisories
# Check for security advisories on uvicorn 0.4.6
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: PIP, package: "uvicorn") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: salimfadhley/dockerized_python_playground
Length of output: 521
🌐 Web query:
FastAPI 0.136.0 uvicorn version requirements
💡 Result:
FastAPI 0.136.0 does not appear to exist as of 2026-04-16. The latest version is 0.135.3 (released 2026-04-01). FastAPI does not have a direct runtime dependency on Uvicorn; Uvicorn is an optional dependency included in the [standard] extras. Uvicorn requirement: uvicorn[standard] >=0.12.0 (from pyproject.toml master branch and PyPI metadata for recent versions). To run a FastAPI app, install with: pip install "fastapi[standard]" This includes Uvicorn >=0.12.0 with high-performance extras like uvloop. No specific changes or tighter bounds for recent versions like 0.135.x; the minimum remains >=0.12.0 across all extras (standard, standard-no-fastapi-cloud-cli, all).
Citations:
- 1: https://pypi.org/project/fastapi/
- 2: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
- 3: https://github.com/tiangolo/fastapi/blob/master/pyproject.toml
- 4: https://pypi.org/project/fastapi/0.135.0/
- 5: https://pypi.org/project/fastapi/0.135.1/
Update uvicorn to a compatible version and address security vulnerabilities.
uvicorn 0.4.6 is deprecated and contains HIGH severity security vulnerabilities (log injection and HTTP response splitting affecting versions < 0.11.7). It is incompatible with any modern FastAPI version, which requires uvicorn >=0.12.0. Update to a recent version (0.23.x or later recommended).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` at line 3, Replace the deprecated pinned uvicorn==0.4.6
in requirements.txt with a modern, secure release (for example update to
uvicorn>=0.23.0 or pin to a 0.23.x release) to remove the log injection/HTTP
response splitting vulnerabilities and satisfy FastAPI's minimum uvicorn
requirement; after changing the uvicorn entry in requirements.txt, re-run
dependency installation and the test suite (and any security scanner) to ensure
compatibility with FastAPI and no regressions.
|
Closing this in favor of #570 |
1 participant
This PR updates fastapi from 0.6.4 to 0.136.0.
Changelog
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1
0.128.0
0.127.1
0.127.0
0.126.0
0.125.0
0.124.4
0.124.3
0.124.2
0.124.1
0.124.0
0.123.10
0.123.9
0.123.8
0.123.7
0.123.6
0.123.5
0.123.4
0.123.3
0.123.2
0.123.1
0.123.0
0.122.1
0.122.0
0.121.3
0.121.2