Update fastapi to 0.136.1 - #570
Conversation
📝 WalkthroughWalkthroughThe pull request updates the pinned version of the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/requirements.txt`:
- Line 1: The requirements pin lists fastapi==0.136.1 which is incompatible with
the pinned uvicorn (very old) and appears unused; either remove the FastAPI
entry from requirements.txt to avoid a broken dependency, or if FastAPI is
intended, update requirements.txt to include a compatible uvicorn (>=0.12.0) and
adjust the package entry points/setup.py web app launch configuration
accordingly; search for "fastapi" and "uvicorn" references and update the
requirements.txt entry and setup.py entry_points/console_scripts to match the
chosen approach.
- Line 2: The requirements file lists an unpinned, vulnerable dependency
"gitpython"; update src/requirements.txt to pin GitPython to a secure release
(e.g., change "gitpython" to "gitpython>=3.1.41" or "gitpython==3.1.47") to
remediate RCE, LFI and Windows search-path issues and ensure the dependency is
locked to a non-vulnerable version.
- Line 3: The requirements file pins uvicorn==0.4.6 which has known HIGH
severity vulnerabilities; update the uvicorn pin in src/requirements.txt
(replace the token "uvicorn==0.4.6") to a secure version (>=0.12.0, preferably
the latest 0.46.0), then regenerate any lock files or virtualenvs and run tests
to ensure compatibility with ASGI setup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.136.1 | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Search for FastAPI usage across the codebase
echo "=== Searching for FastAPI imports ==="
rg -n --type=py 'from fastapi|import fastapi' -C 2
echo -e "\n=== Searching for FastAPI app instantiation ==="
rg -n --type=py 'FastAPI\(' -C 2
echo -e "\n=== Searching for FastAPI decorators ==="
rg -n --type=py '@app\.(get|post|put|delete|patch)' -C 2Repository: salimfadhley/dockerized_python_playground
Length of output: 213
🌐 Web query:
What is the minimum uvicorn version required by FastAPI 0.136.1?
💡 Result:
The minimum uvicorn version required by FastAPI 0.136.1 is 0.12.0 (with [standard] extras for high performance, including uvloop).
Citations:
- 1: https://pypi.org/project/fastapi/
- 2: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
Critical: FastAPI 0.136.1 is incompatible with uvicorn 0.4.6; also, FastAPI is not used in this codebase.
FastAPI 0.136.1 requires a minimum uvicorn version of 0.12.0, but uvicorn 0.4.6 (pinned in requirements) is far too old and will cause runtime failures. Additionally, no FastAPI imports, app instantiation, or route decorators were found anywhere in the codebase, indicating FastAPI is not actually used.
Either remove FastAPI from requirements if it's unintended, or if FastAPI integration is planned, update uvicorn to at least 0.12.0 and address the corresponding setup.py entry point misconfigurations.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2022-42992)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-137)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-161)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2023-165)
[CRITICAL] 1-1: gitpython 3.1.9: undefined
(PYSEC-2024-4)
[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution
[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation
[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` at line 1, The requirements pin lists fastapi==0.136.1
which is incompatible with the pinned uvicorn (very old) and appears unused;
either remove the FastAPI entry from requirements.txt to avoid a broken
dependency, or if FastAPI is intended, update requirements.txt to include a
compatible uvicorn (>=0.12.0) and adjust the package entry points/setup.py web
app launch configuration accordingly; search for "fastapi" and "uvicorn"
references and update the requirements.txt entry and setup.py
entry_points/console_scripts to match the chosen approach.
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.136.1 | |||
| gitpython | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check gitpython for latest version and security advisories
echo "=== Latest gitpython version ==="
curl -s https://pypi.org/pypi/gitpython/json | jq -r '.info.version'
echo -e "\n=== Security advisories for gitpython ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: PIP, package: "gitpython") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: salimfadhley/dockerized_python_playground
Length of output: 1443
Pin gitpython to a secure version (currently unpinned and vulnerable).
The unpinned gitpython dependency has multiple critical security vulnerabilities:
- Remote Code Execution (CRITICAL) - affects versions < 3.1.32 and <= 3.1.29
- Blind local file inclusion (MODERATE) - affects versions < 3.1.37
- Untrusted search path on Windows (HIGH) - affects versions <= 3.1.32 and < 3.1.41
Pin gitpython>=3.1.41 (or 3.1.47 for the latest version) to address all known vulnerabilities.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` at line 2, The requirements file lists an unpinned,
vulnerable dependency "gitpython"; update src/requirements.txt to pin GitPython
to a secure release (e.g., change "gitpython" to "gitpython>=3.1.41" or
"gitpython==3.1.47") to remediate RCE, LFI and Windows search-path issues and
ensure the dependency is locked to a non-vulnerable version.
| fastapi==0.6.4 | ||
| fastapi==0.136.1 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check uvicorn for latest version and security advisories
echo "=== Latest uvicorn version ==="
curl -s https://pypi.org/pypi/uvicorn/json | jq -r '.info.version'
echo -e "\n=== Security advisories for uvicorn ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: PIP, package: "uvicorn") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: salimfadhley/dockerized_python_playground
Length of output: 600
🏁 Script executed:
# Find and examine requirements.txt
find . -name "requirements.txt" -type f -exec head -20 {} +Repository: salimfadhley/dockerized_python_playground
Length of output: 126
🏁 Script executed:
# Check FastAPI version if it exists in the requirements
if [ -f "src/requirements.txt" ]; then
echo "=== Full src/requirements.txt ==="
cat src/requirements.txt
fiRepository: salimfadhley/dockerized_python_playground
Length of output: 160
🌐 Web query:
FastAPI 0.136.1 uvicorn version requirements dependencies
💡 Result:
FastAPI version 0.136.1 does not appear to exist as of 2026-04-23. The latest released version is 0.136.0 (released 2026-04-16). FastAPI does not have a strict runtime dependency on Uvicorn. Uvicorn is included as an optional dependency in the "standard" extras group. From FastAPI's pyproject.toml (current master, matching 0.136.0): Under [project.optional-dependencies.standard]: - "uvicorn[standard] >=0.12.0" This is the recommended Uvicorn version for use with FastAPI 0.136.0, including uvloop for high performance. To install FastAPI with standard dependencies (including Uvicorn): pip install "fastapi[standard]" Core runtime dependencies of FastAPI (not optional): - starlette >=0.46.0 - pydantic >=2.9.0 - typing-extensions >=4.8.0 - typing-inspection >=0.4.2 - annotated-doc >=0.0.2 Uvicorn is the recommended ASGI server for running FastAPI applications: uvicorn main:app --reload
Citations:
- 1: fastapi/fastapi@0.135.4...0.136.0
- 2: https://fastapi.tiangolo.com/
- 3: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
- 4: https://pypi.org/project/fastapi/
- 5: https://github.com/fastapi/fastapi/releases/latest
Critical: uvicorn 0.4.6 has HIGH severity security vulnerabilities.
uvicorn 0.4.6 contains two HIGH severity security vulnerabilities:
- Log injection (GHSA-33c7-2mpw-hg34)
- HTTP response splitting (GHSA-f97h-2pfx-f59f)
Both are patched in uvicorn 0.11.7 and later. Additionally, this version is extremely outdated (released ~2019) and incompatible with any modern ASGI setup.
Upgrade to uvicorn >=0.12.0 (or latest 0.46.0).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/requirements.txt` at line 3, The requirements file pins uvicorn==0.4.6
which has known HIGH severity vulnerabilities; update the uvicorn pin in
src/requirements.txt (replace the token "uvicorn==0.4.6") to a secure version
(>=0.12.0, preferably the latest 0.46.0), then regenerate any lock files or
virtualenvs and run tests to ensure compatibility with ASGI setup.
|
Closing this in favor of #577 |
1 participant
This PR updates fastapi from 0.6.4 to 0.136.1.
Changelog
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1
0.128.0
0.127.1
0.127.0
0.126.0
0.125.0
0.124.4
0.124.3
0.124.2
0.124.1
0.124.0
0.123.10
0.123.9
0.123.8
0.123.7
0.123.6
0.123.5
0.123.4
0.123.3
0.123.2
0.123.1