Skip to content

Update fastapi to 0.137.1 #582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.137.1 #582

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.137.1
gitpython
uvicorn==0.4.6
Comment on lines +1 to 3

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# Find minimum compatible uvicorn version for fastapi 0.137.1
pip index versions fastapi==0.137.1 2>/dev/null | grep -A 5 'uvicorn'
# Or check FastAPI's pyproject.toml or setup.py for uvicorn dependency constraints

Repository: salimfadhley/dockerized_python_playground

Length of output: 67

🏁 Script executed:

cat -n src/requirements.txt

Repository: salimfadhley/dockerized_python_playground

Length of output: 148

🏁 Script executed:

git ls-files | head -20

Repository: salimfadhley/dockerized_python_playground

Length of output: 508

🏁 Script executed:

fd pyproject.toml setup.py setup.cfg -type f

Repository: salimfadhley/dockerized_python_playground

Length of output: 256

🌐 Web query:

uvicorn 0.4.6 fastapi 0.137.1 compatibility

💡 Result:

Uvicorn 0.4.6 and FastAPI 0.137.1 are not recommended for use together due to the significant age gap between them [1][2][3]. Uvicorn 0.4.6 was released on February 25, 2019 [1][4], and FastAPI 0.137.1 was released in June 2026 [5][6]. FastAPI is designed to run on top of modern ASGI servers that implement current ASGI specifications [7]. Using such an outdated version of Uvicorn with a current version of FastAPI will likely result in compatibility issues, missing features, and security vulnerabilities [8]. For a functional and secure FastAPI application, you should use a modern, up-to-date version of Uvicorn [9][7]. The recommended approach is to install the standard extra, which ensures you have the necessary dependencies for performance and full feature support [10][7]: pip install "uvicorn[standard]" This will provide you with a version compatible with current FastAPI releases, ensuring proper support for ASGI features, event loop management, and WebSocket handling [10][11].

Citations:

🌐 Web query:

uvicorn 0.4.6 security vulnerabilities CVE PYSEC

💡 Result:

Uvicorn version 0.4.6 is affected by at least two major security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. The vulnerabilities are: 1. ANSI Escape Sequence Injection (CVE-2020-7694 / PYSEC-2020-150 / GHSA-33c7-2mpw-hg34): The application's request logger is vulnerable to ANSI escape sequence injection [3][4]. Attackers can supply crafted URLs containing percent-encoded escape sequences, which the logging component processes and writes to logs [3][5]. This allows attackers to pollute access logs or potentially interact with terminal emulators displaying the logs [3][6]. 2. HTTP Response Splitting (CVE-2020-7695 / PYSEC-2020-151 / GHSA-f97h-2pfx-f59f): Uvicorn versions prior to 0.11.7 are vulnerable to HTTP response splitting [7][8]. The issue arises because CRLF sequences are not properly escaped in HTTP header values [9][8]. This vulnerability can be exploited to inject arbitrary headers into HTTP responses or return an arbitrary response body [7][8]. Both vulnerabilities affect all versions of Uvicorn up to, and including, version 0.11.6 [7][8]. Users are strongly advised to upgrade to a newer, patched version of Uvicorn [7][2].

Citations:

🌐 Web query:

fastapi 0.137.1 minimum uvicorn version requirements

💡 Result:

For FastAPI version 0.137.1, the minimum version requirement for Uvicorn (when installed as part of the optional standard dependencies) is uvicorn[standard] >=0.12.0 [1]. While FastAPI includes this requirement in its pyproject.toml to ensure compatibility for standard installations [1], it is generally recommended to use a more recent version of Uvicorn to benefit from performance improvements, bug fixes, and security updates. You can install the standard set of dependencies, including the required Uvicorn version, using the following command [2]: pip install "fastapi[standard]"

Citations:

🌐 Web query:

uvicorn 0.27.0 fastapi 0.137.1 compatible

💡 Result:

Uvicorn 0.27.0 and FastAPI 0.137.1 are compatible [1][2]. FastAPI and Uvicorn are separate projects that communicate via the ASGI (Asynchronous Server Gateway Interface) standard [3]. Because they rely on this standardized interface rather than tight, version-specific coupling, they are generally compatible across their respective releases [3]. For context on these specific versions: - Uvicorn 0.27.0 was released on January 22, 2024 [1][4]. - FastAPI 0.137.1 is a much newer release, dated June 15, 2026 [2]. While they are compatible, it is standard practice to ensure you are using a modern version of Uvicorn that supports the latest features and security patches, as Uvicorn has seen many releases since 0.27.0 [5]. You can run them together using standard commands such as uvicorn main:app [6].

Citations:

Update uvicorn to 0.27.0 or newer—0.4.6 is incompatible with FastAPI 0.137.1 and carries unpatched security vulnerabilities.

Uvicorn 0.4.6 (released February 2019) is significantly outdated relative to FastAPI 0.137.1 (June 2026). The combination will cause failures and expose your application to known CVEs:

Both are fixed in uvicorn 0.11.7+. Update to uvicorn 0.27.0+ in src/requirements.txt to ensure compatibility with FastAPI 0.137.1 and patch these vulnerabilities.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` around lines 1 - 3, Update the uvicorn version
specification from 0.4.6 to 0.27.0 or newer in the requirements.txt file. The
current version 0.4.6 is incompatible with FastAPI 0.137.1 and contains
unpatched security vulnerabilities (CVE-2020-7694 and CVE-2020-7695). Change the
line that currently reads uvicorn==0.4.6 to uvicorn==0.27.0 (or a newer stable
release) to ensure compatibility and patch the known security issues.

Source: Linters/SAST tools