Skip to content

Update fastapi to 0.136.1 #570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.136.1 #570

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.136.1

@coderabbitai coderabbitai Bot Apr 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Search for FastAPI usage across the codebase

echo "=== Searching for FastAPI imports ==="
rg -n --type=py 'from fastapi|import fastapi' -C 2

echo -e "\n=== Searching for FastAPI app instantiation ==="
rg -n --type=py 'FastAPI\(' -C 2

echo -e "\n=== Searching for FastAPI decorators ==="
rg -n --type=py '@app\.(get|post|put|delete|patch)' -C 2

Repository: salimfadhley/dockerized_python_playground

Length of output: 213

🌐 Web query:

What is the minimum uvicorn version required by FastAPI 0.136.1?

💡 Result:

The minimum uvicorn version required by FastAPI 0.136.1 is 0.12.0 (with [standard] extras for high performance, including uvloop).

Citations:

Critical: FastAPI 0.136.1 is incompatible with uvicorn 0.4.6; also, FastAPI is not used in this codebase.

FastAPI 0.136.1 requires a minimum uvicorn version of 0.12.0, but uvicorn 0.4.6 (pinned in requirements) is far too old and will cause runtime failures. Additionally, no FastAPI imports, app instantiation, or route decorators were found anywhere in the codebase, indicating FastAPI is not actually used.

Either remove FastAPI from requirements if it's unintended, or if FastAPI integration is planned, update uvicorn to at least 0.12.0 and address the corresponding setup.py entry point misconfigurations.

🧰 Tools
🪛 OSV Scanner (2.3.5)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/requirements.txt` at line 1, The requirements pin lists fastapi==0.136.1
which is incompatible with the pinned uvicorn (very old) and appears unused;
either remove the FastAPI entry from requirements.txt to avoid a broken
dependency, or if FastAPI is intended, update requirements.txt to include a
compatible uvicorn (>=0.12.0) and adjust the package entry points/setup.py web
app launch configuration accordingly; search for "fastapi" and "uvicorn"
references and update the requirements.txt entry and setup.py
entry_points/console_scripts to match the chosen approach.

gitpython

@coderabbitai coderabbitai Bot Apr 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check gitpython for latest version and security advisories

echo "=== Latest gitpython version ==="
curl -s https://pypi.org/pypi/gitpython/json | jq -r '.info.version'

echo -e "\n=== Security advisories for gitpython ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: PIP, package: "gitpython") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: salimfadhley/dockerized_python_playground

Length of output: 1443

Pin gitpython to a secure version (currently unpinned and vulnerable).

The unpinned gitpython dependency has multiple critical security vulnerabilities:

  • Remote Code Execution (CRITICAL) - affects versions < 3.1.32 and <= 3.1.29
  • Blind local file inclusion (MODERATE) - affects versions < 3.1.37
  • Untrusted search path on Windows (HIGH) - affects versions <= 3.1.32 and < 3.1.41

Pin gitpython>=3.1.41 (or 3.1.47 for the latest version) to address all known vulnerabilities.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/requirements.txt` at line 2, The requirements file lists an unpinned,
vulnerable dependency "gitpython"; update src/requirements.txt to pin GitPython
to a secure release (e.g., change "gitpython" to "gitpython>=3.1.41" or
"gitpython==3.1.47") to remediate RCE, LFI and Windows search-path issues and
ensure the dependency is locked to a non-vulnerable version.

uvicorn==0.4.6

@coderabbitai coderabbitai Bot Apr 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check uvicorn for latest version and security advisories

echo "=== Latest uvicorn version ==="
curl -s https://pypi.org/pypi/uvicorn/json | jq -r '.info.version'

echo -e "\n=== Security advisories for uvicorn ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 10, ecosystem: PIP, package: "uvicorn") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: salimfadhley/dockerized_python_playground

Length of output: 600

🏁 Script executed:

# Find and examine requirements.txt
find . -name "requirements.txt" -type f -exec head -20 {} +

Repository: salimfadhley/dockerized_python_playground

Length of output: 126

🏁 Script executed:

# Check FastAPI version if it exists in the requirements
if [ -f "src/requirements.txt" ]; then
  echo "=== Full src/requirements.txt ===" 
  cat src/requirements.txt
fi

Repository: salimfadhley/dockerized_python_playground

Length of output: 160

🌐 Web query:

FastAPI 0.136.1 uvicorn version requirements dependencies

💡 Result:

FastAPI version 0.136.1 does not appear to exist as of 2026-04-23. The latest released version is 0.136.0 (released 2026-04-16). FastAPI does not have a strict runtime dependency on Uvicorn. Uvicorn is included as an optional dependency in the "standard" extras group. From FastAPI's pyproject.toml (current master, matching 0.136.0): Under [project.optional-dependencies.standard]: - "uvicorn[standard] >=0.12.0" This is the recommended Uvicorn version for use with FastAPI 0.136.0, including uvloop for high performance. To install FastAPI with standard dependencies (including Uvicorn): pip install "fastapi[standard]" Core runtime dependencies of FastAPI (not optional): - starlette >=0.46.0 - pydantic >=2.9.0 - typing-extensions >=4.8.0 - typing-inspection >=0.4.2 - annotated-doc >=0.0.2 Uvicorn is the recommended ASGI server for running FastAPI applications: uvicorn main:app --reload

Citations:

Critical: uvicorn 0.4.6 has HIGH severity security vulnerabilities.

uvicorn 0.4.6 contains two HIGH severity security vulnerabilities:

Both are patched in uvicorn 0.11.7 and later. Additionally, this version is extremely outdated (released ~2019) and incompatible with any modern ASGI setup.

Upgrade to uvicorn >=0.12.0 (or latest 0.46.0).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/requirements.txt` at line 3, The requirements file pins uvicorn==0.4.6
which has known HIGH severity vulnerabilities; update the uvicorn pin in
src/requirements.txt (replace the token "uvicorn==0.4.6") to a secure version
(>=0.12.0, preferably the latest 0.46.0), then regenerate any lock files or
virtualenvs and run tests to ensure compatibility with ASGI setup.