Skip to content

Update fastapi to 0.136.3 #577

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.136.3 #577

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.136.3
gitpython
uvicorn==0.4.6

@coderabbitai coderabbitai Bot May 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify current declared pins
nl -ba src/requirements.txt

# Re-check advisories for the exact uvicorn pin in this repo
python - <<'PY'
import re, pathlib
req = pathlib.Path("src/requirements.txt").read_text()
m = re.search(r'^\s*uvicorn==([0-9][^\s]*)\s*$', req, re.M)
print("uvicorn pin:", m.group(1) if m else "not pinned with ==")
PY

# Optional: if available in your CI image, run one of these:
# pip-audit -r src/requirements.txt
# osv-scanner --lockfile=src/requirements.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 128

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Confirm exact pins in src/requirements.txt (avoid `nl` which isn't available)
echo "---- src/requirements.txt ----"
cat src/requirements.txt

echo
echo "---- Extract uvicorn pin ----"
python3 - <<'PY'
import pathlib, re
req = pathlib.Path("src/requirements.txt").read_text()
m = re.search(r'(?m)^\s*uvicorn==\s*([0-9][^\s]*)\s*$', req)
print(m.group(1) if m else "no exact uvicorn== pin")
PY

Repository: salimfadhley/dockerized_python_playground

Length of output: 195

🌐 Web query:

uvicorn 0.4.6 security advisory GHSA-33c7-2mpw-hg34 GHSA-f97h-2pfx-f59f PYSEC-2020-150 PYSEC-2020-151

💡 Result:

For uvicorn 0.4.6, the following advisories apply (all are aliases to the same underlying issues described below): 1) GHSA-33c7-2mpw-hg34 (alias: CVE-2020-7694; alias: PYSEC-2020-150) - Impact: log injection / ANSI escape sequence injection via crafted request URLs, because the request logger logs the URL after urllib.parse.unquote converts percent-encoded sequences into single characters with special meaning in terminal emulators.[1][2] - Affected versions: OSV lists uvicorn versions including 0.4.6 as affected.[1][3] 2) GHSA-f97h-2pfx-f59f (alias: CVE-2020-7695; <your query’s list includes PYSEC-2020-151, which OSV/NVD link to this HTTP response splitting issue>) - Impact: HTTP response splitting. Uvicorn is vulnerable when CRLF sequences are not escaped in HTTP header values, allowing attackers to inject arbitrary headers or even an arbitrary response body when crafted input is used to construct HTTP headers.[4] - Affected versions: OSV lists uvicorn versions including 0.4.6 as affected (via the CVE-2020-7695 / GHSA-f97h-2pfx-f59f mapping).[4][5] What to do - If you are running uvicorn 0.4.6: upgrade to a version that is fixed for these CVEs. Public guidance for these specific issues indicates they are fixed in uvicorn 0.11.7 (or later): “This is fixed in 0.11.7.”[6]

Citations:

Upgrade uvicorn==0.4.6 in src/requirements.txt
uvicorn==0.4.6 is affected by GHSA-33c7-2mpw-hg34 (CVE-2020-7694 / PYSEC-2020-150) and GHSA-f97h-2pfx-f59f (CVE-2020-7695 / PYSEC-2020-151). Upgrade to uvicorn>=0.11.7 (or later).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 3, Update the pinned vulnerable dependency in
src/requirements.txt: replace the exact version spec uvicorn==0.4.6 with a
secure minimum version such as uvicorn>=0.11.7 (or a later stable release) in
the requirements file; after changing the uvicorn version, regenerate any
lock/constraint files and run the test suite or a quick smoke test to ensure
compatibility with functions that call Uvicorn (e.g., any start/serve code that
uses uvicorn.run).