From 1bb2e141d1b0f62dc5bda8e6b7faee2f5c99b735 Mon Sep 17 00:00:00 2001 From: Ha Vu Date: Mon, 17 Aug 2026 17:17:52 -0400 Subject: [PATCH 1/2] Bump fastapi to >=0.136.3 for Python >= 3.10 to fix PYSEC-2026-161 Signed-off-by: Ha Vu --- pyproject.toml | 8 ++++++-- web/server/settings.py | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index ca7527868d..f29296bdd8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -134,7 +134,10 @@ snowflake = [ starrocks = ["pymysql"] trino = ["trino"] web = [ - "fastapi==0.120.1", + # fastapi>=0.136.3 brings in starlette>=1.0.1, which fixes PYSEC-2026-161. + # Both require Python >= 3.10, so 3.9 stays on the previous pin. + "fastapi>=0.136.3; python_version >= '3.10'", + "fastapi==0.120.1; python_version < '3.10'", "watchfiles>=0.19.0", "uvicorn[standard]==0.22.0", "sse-starlette>=0.2.2", @@ -142,7 +145,8 @@ web = [ ] lsp = [ # Duplicate of web - "fastapi==0.120.1", + "fastapi>=0.136.3; python_version >= '3.10'", + "fastapi==0.120.1; python_version < '3.10'", "watchfiles>=0.19.0", # "uvicorn[standard]==0.22.0", "sse-starlette>=0.2.2", diff --git a/web/server/settings.py b/web/server/settings.py index a96d369de8..d893f52afa 100644 --- a/web/server/settings.py +++ b/web/server/settings.py @@ -96,7 +96,7 @@ def get_path_to_model_mapping( def get_loaded_context( settings: Settings = Depends(get_settings), -) -> t.Generator[Context, None]: +) -> t.Generator[Context, None, None]: try: with get_loaded_context_lock: yield _get_loaded_context(settings.project_path, settings.config, settings.gateway) From 1e57049541080e4ec8ad95eebf4435747e202b8d Mon Sep 17 00:00:00 2001 From: Ha Vu Date: Tue, 18 Aug 2026 10:14:31 -0400 Subject: [PATCH 2/2] PYSEC-2026-161 is fixed in starlette>=1.0.1. fastapi==0.120.1 caps starlette<0.50.0, so it has to be bumped to lift that cap, but fastapi>=0.136.3 only requires starlette>=0.46.0 and would still resolve to a vulnerable version -- hence the explicit starlette floor below. Both requirements need Python >= 3.10, so 3.9 stays on the previous pin. Signed-off-by: Ha Vu --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index f29296bdd8..bc12bc30ff 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -134,9 +134,8 @@ snowflake = [ starrocks = ["pymysql"] trino = ["trino"] web = [ - # fastapi>=0.136.3 brings in starlette>=1.0.1, which fixes PYSEC-2026-161. - # Both require Python >= 3.10, so 3.9 stays on the previous pin. "fastapi>=0.136.3; python_version >= '3.10'", + "starlette>=1.0.1; python_version >= '3.10'", "fastapi==0.120.1; python_version < '3.10'", "watchfiles>=0.19.0", "uvicorn[standard]==0.22.0", @@ -146,6 +145,7 @@ web = [ lsp = [ # Duplicate of web "fastapi>=0.136.3; python_version >= '3.10'", + "starlette>=1.0.1; python_version >= '3.10'", "fastapi==0.120.1; python_version < '3.10'", "watchfiles>=0.19.0", # "uvicorn[standard]==0.22.0",