Update fastapi to 0.136.3 - #577
Conversation
📝 WalkthroughWalkthroughFastAPI dependency version is updated from 0.6.4 to 0.136.3 in ChangesFastAPI Dependency Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 3: Update the pinned vulnerable dependency in src/requirements.txt:
replace the exact version spec uvicorn==0.4.6 with a secure minimum version such
as uvicorn>=0.11.7 (or a later stable release) in the requirements file; after
changing the uvicorn version, regenerate any lock/constraint files and run the
test suite or a quick smoke test to ensure compatibility with functions that
call Uvicorn (e.g., any start/serve code that uses uvicorn.run).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| fastapi==0.6.4 | ||
| fastapi==0.136.3 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify current declared pins
nl -ba src/requirements.txt
# Re-check advisories for the exact uvicorn pin in this repo
python - <<'PY'
import re, pathlib
req = pathlib.Path("src/requirements.txt").read_text()
m = re.search(r'^\s*uvicorn==([0-9][^\s]*)\s*$', req, re.M)
print("uvicorn pin:", m.group(1) if m else "not pinned with ==")
PY
# Optional: if available in your CI image, run one of these:
# pip-audit -r src/requirements.txt
# osv-scanner --lockfile=src/requirements.txtRepository: salimfadhley/dockerized_python_playground
Length of output: 128
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Confirm exact pins in src/requirements.txt (avoid `nl` which isn't available)
echo "---- src/requirements.txt ----"
cat src/requirements.txt
echo
echo "---- Extract uvicorn pin ----"
python3 - <<'PY'
import pathlib, re
req = pathlib.Path("src/requirements.txt").read_text()
m = re.search(r'(?m)^\s*uvicorn==\s*([0-9][^\s]*)\s*$', req)
print(m.group(1) if m else "no exact uvicorn== pin")
PYRepository: salimfadhley/dockerized_python_playground
Length of output: 195
🌐 Web query:
uvicorn 0.4.6 security advisory GHSA-33c7-2mpw-hg34 GHSA-f97h-2pfx-f59f PYSEC-2020-150 PYSEC-2020-151
💡 Result:
For uvicorn 0.4.6, the following advisories apply (all are aliases to the same underlying issues described below): 1) GHSA-33c7-2mpw-hg34 (alias: CVE-2020-7694; alias: PYSEC-2020-150) - Impact: log injection / ANSI escape sequence injection via crafted request URLs, because the request logger logs the URL after urllib.parse.unquote converts percent-encoded sequences into single characters with special meaning in terminal emulators.[1][2] - Affected versions: OSV lists uvicorn versions including 0.4.6 as affected.[1][3] 2) GHSA-f97h-2pfx-f59f (alias: CVE-2020-7695; <your query’s list includes PYSEC-2020-151, which OSV/NVD link to this HTTP response splitting issue>) - Impact: HTTP response splitting. Uvicorn is vulnerable when CRLF sequences are not escaped in HTTP header values, allowing attackers to inject arbitrary headers or even an arbitrary response body when crafted input is used to construct HTTP headers.[4] - Affected versions: OSV lists uvicorn versions including 0.4.6 as affected (via the CVE-2020-7695 / GHSA-f97h-2pfx-f59f mapping).[4][5] What to do - If you are running uvicorn 0.4.6: upgrade to a version that is fixed for these CVEs. Public guidance for these specific issues indicates they are fixed in uvicorn 0.11.7 (or later): “This is fixed in 0.11.7.”[6]
Citations:
- 1: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 2: https://github.com/encode/uvicorn/blob/master/docs/release-notes.md
- 3: https://pypi.org/project/uvicorn/
- 4: https://sca.analysiscenter.veracode.com/vulnerability-database/security/crlf-injection/python/sid-25969
- 5: https://dev.to/meroline_lizlent/uvicorn-the-lightning-fast-asgi-server-powering-modern-python-apps-5a85
- 6: https://github.com/encode/uvicorn/blob/master/uvicorn/main.py
Upgrade uvicorn==0.4.6 in src/requirements.txt
uvicorn==0.4.6 is affected by GHSA-33c7-2mpw-hg34 (CVE-2020-7694 / PYSEC-2020-150) and GHSA-f97h-2pfx-f59f (CVE-2020-7695 / PYSEC-2020-151). Upgrade to uvicorn>=0.11.7 (or later).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 3, Update the pinned vulnerable dependency in
src/requirements.txt: replace the exact version spec uvicorn==0.4.6 with a
secure minimum version such as uvicorn>=0.11.7 (or a later stable release) in
the requirements file; after changing the uvicorn version, regenerate any
lock/constraint files and run the test suite or a quick smoke test to ensure
compatibility with functions that call Uvicorn (e.g., any start/serve code that
uses uvicorn.run).
|
Closing this in favor of #581 |
1 participant
This PR updates fastapi from 0.6.4 to 0.136.3.
Changelog
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1
0.128.0
0.127.1
0.127.0
0.126.0
0.125.0
0.124.4
0.124.3