Update fastapi to 0.139.0 - #588
Conversation
📝 WalkthroughWalkthroughThe ChangesDependency update
Estimated code review effort: 1 (Trivial) | ~2 minutes Related issues: None specified. Related PRs: None specified. Suggested labels: dependencies Suggested reviewers: None specified. 🐰 A tiny hop, a version bump, 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Line 1: The dependency pins need to be updated together: fastapi is already
pinned, but uvicorn remains on an unsafe old release. In requirements.txt,
update the uvicorn version pin to at least 0.11.7 alongside the FastAPI bump,
keeping the dependency list consistent and using the existing package entry to
locate the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,3 +1,3 @@ | |||
| fastapi==0.6.4 | |||
| fastapi==0.139.0 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repo files matching requirements:\n'
git ls-files | rg '(^|/)(requirements|pyproject|poetry.lock|Pipfile)(\.|$)|requirements\.txt$'
printf '\nContents of src/requirements.txt with line numbers:\n'
cat -n src/requirements.txt
printf '\nSearch for uvicorn pin references:\n'
rg -n "uvicorn|fastapi|gitpython" src/requirements.txt . -g 'requirements.txt' -g 'pyproject.toml' -g 'Pipfile' -g 'Pipfile.lock' -g 'poetry.lock' || trueRepository: salimfadhley/dockerized_python_playground
Length of output: 614
🌐 Web query:
uvicorn 0.4.6 security advisory log injection HTTP response splitting
💡 Result:
Uvicorn version 0.4.6 is affected by two high-severity security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. 1. HTTP Response Splitting (CVE-2020-7695): Uvicorn versions before 0.11.7 are vulnerable to HTTP response splitting because they fail to properly escape CRLF (carriage return/line feed) sequences in HTTP header values [1][3]. An attacker can exploit this by providing crafted input that results in the insertion of arbitrary HTTP headers or even an arbitrary response body [4][3]. 2. Log Injection and ANSI Escape Sequence Injection (CVE-2020-7694): Uvicorn versions before 0.11.7 are also vulnerable to log injection via ANSI escape sequence injection [2][5]. The server's default request logger processes URLs using urllib.parse.unquote before logging them [6][2]. An attacker can request crafted URLs containing percent-encoded ANSI escape sequences, which, when decoded and logged, can: * Pollute access logs with fake entries [6][5]. * Interact with terminal emulators displaying the logs, potentially leading to unauthorized terminal control [6][5]. Both issues were publicly disclosed and resolved in uvicorn 0.11.7 [1][2]. It is strongly recommended to upgrade to a version later than 0.11.7 to mitigate these risks [5].
Citations:
- 1: GHSA-f97h-2pfx-f59f
- 2: GHSA-33c7-2mpw-hg34
- 3: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 4: https://osv.dev/vulnerability/GHSA-f97h-2pfx-f59f
- 5: https://security.snyk.io/vuln/SNYK-PYTHON-UVICORN-575560
- 6: https://github.com/pypa/advisory-database/blob/main/vulns/uvicorn/PYSEC-2020-150.yaml
🌐 Web query:
uvicorn 0.4.6 vulnerabilities CVE
💡 Result:
Uvicorn version 0.4.6 is affected by two known security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. The vulnerabilities are: 1. Log Injection (CVE-2020-7694): This vulnerability allows attackers to perform ANSI escape sequence injection through the request logger [2][3]. By requesting crafted URLs, an attacker can pollute access logs or interact with the terminal emulator displaying the logs [4][3]. 2. HTTP Response Splitting (CVE-2020-7695): This vulnerability occurs because CRLF (Carriage Return Line Feed) sequences are not properly escaped in HTTP header values [2][5]. Attackers can exploit this to inject arbitrary headers into HTTP responses or return an arbitrary response body [2][5]. Because version 0.4.6 is significantly older than the patched version (0.11.7), it is recommended to update to a modern, supported version of Uvicorn to mitigate these and other potential security risks [2][6].
Citations:
- 1: https://pypi.org/project/uvicorn/0.4.6/
- 2: https://www.versioneye.com/Python/uvicorn/0.4.6
- 3: https://nvd.nist.gov/vuln/detail/cve-2020-7694
- 4: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 5: https://osv.dev/vulnerability/PYSEC-2020-151
- 6: https://www.sherlockforensics.com/security/pypi/uvicorn.html
Update the ASGI server pin too. uvicorn==0.4.6 is still pinned here, and that release is affected by log-injection and HTTP response-splitting issues fixed in 0.11.7. Bump it alongside FastAPI.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` at line 1, The dependency pins need to be updated
together: fastapi is already pinned, but uvicorn remains on an unsafe old
release. In requirements.txt, update the uvicorn version pin to at least 0.11.7
alongside the FastAPI bump, keeping the dependency list consistent and using the
existing package entry to locate the change.
Source: Linters/SAST tools
|
Closing this in favor of #597 |
1 participant
This PR updates fastapi from 0.6.4 to 0.139.0.
Changelog
0.139.0
0.138.1
0.138.0
0.137.2
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2