Skip to content

Update fastapi to 0.138.2 #587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
pyup-bot wants to merge 1 commit into from
Closed

Update fastapi to 0.138.2 #587

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
fastapi==0.6.4
fastapi==0.138.2

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift

Uvicorn 0.4.6 is incompatible with FastAPI 0.138.2.

FastAPI 0.138.2 requires Starlette 1.0.0+, which in turn requires a modern uvicorn. Uvicorn 0.4.6 dates to ~2019 and lacks ASGI features that modern Starlette depends on. This version combination will likely fail at runtime with import errors or missing ASGI protocol support.

Update uvicorn to a compatible version (0.34.0+ recommended for Starlette 1.1+ / FastAPI 0.115+). Verify with:

#!/bin/bash
# Check uvicorn compatibility with fastapi 0.138.2
python -m pip index versions uvicorn 2>/dev/null || echo "pip index not available"
# Alternative: check PyPI for latest
curl -s https://pypi.org/pypi/uvicorn/json | jq '.info.version'
🧰 Tools
🪛 OSV Scanner (2.4.0)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2022-42992)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-137)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-161)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2023-165)

[CRITICAL] 1-1: gitpython 3.1.9: undefined

(PYSEC-2024-4)

[CRITICAL] 1-1: gitpython 3.1.9: Untrusted search path under some conditions on Windows allows arbitrary code execution

(GHSA-2mqj-m65w-jghx)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

(GHSA-7545-fcxq-7j24)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython blind local file inclusion

(GHSA-cwvm-v4w8-q58c)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to Remote Code Execution due to improper user input validation

(GHSA-hcpj-qp55-gfph)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath

(GHSA-mv93-w799-cj2w)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

(GHSA-pr76-5cm5-w9cj)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

(GHSA-v87r-6q3f-2j67)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython untrusted search path on Windows systems leading to arbitrary code execution

(GHSA-wfm5-v35h-vwf4)

[CRITICAL] 1-1: gitpython 3.1.9: GitPython: Unsafe option check validates multi_options before shlex.split transformation

(GHSA-x2qx-6953-8485)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-150)

[HIGH] 1-1: uvicorn 0.4.6: undefined

(PYSEC-2020-151)

[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn

(GHSA-33c7-2mpw-hg34)

[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn

(GHSA-f97h-2pfx-f59f)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 1, The dependency set is pinning FastAPI
0.138.2 alongside an incompatible old Uvicorn release, so update the uvicorn
requirement in requirements.txt to a modern compatible version (0.34.0+
recommended) and keep it aligned with FastAPI/Starlette support. Adjust the
dependency pin near fastapi==0.138.2, then verify the app imports and ASGI
startup still work with the updated uvicorn version.

gitpython

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

GitPython has multiple critical CVEs and should be pinned or removed.

The unpinned gitpython dependency resolves to 3.1.9 which has 14 critical vulnerabilities including RCE (GHSA-hcpj-qp55-gfph, GHSA-pr76-5cm5-w9cj), path traversal (GHSA-7545-fcxq-7j24), and arbitrary code execution. If GitPython is required, pin to >=3.1.41 (or latest) which patches these CVEs. If unused, remove it.

#!/bin/bash
# Check if gitpython is actually used in the codebase
rg -n "import git" --type=py -g '!*venv*' -g '!*site-packages*'
rg -n "from git" --type=py -g '!*venv*' -g '!*site-packages*'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/requirements.txt` at line 2, The unpinned gitpython dependency in
requirements.txt should be either removed if unused or pinned to a सुरक्षित
fixed version. Check whether any code references GitPython via imports in the
codebase, and if it is needed, update the requirements entry to a version at
least 3.1.41; otherwise delete the dependency line entirely. Use the gitpython
entry in requirements.txt as the target to modify.

Source: Linters/SAST tools

uvicorn==0.4.6