Repository navigation
chore(deps): bump the fastapi-minor-patch group in /reference-apps/fastapi with 4 updates - #374
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the fastapi-minor-patch group in /reference-apps/fastapi with 4 updates: [fastapi](https://github.com/fastapi/fastapi), [asyncpg](https://github.com/MagicStack/asyncpg), [pymongo](https://github.com/mongodb/mongo-python-driver) and [aio-pika](https://github.com/mosquito/aio-pika). Updates `fastapi` from 0.142.2 to 0.143.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.142.2...0.143.0) Updates `asyncpg` from 0.31.0 to 0.32.0 - [Release notes](https://github.com/MagicStack/asyncpg/releases) - [Commits](MagicStack/asyncpg@v0.31.0...v0.32.0) Updates `pymongo` from 4.18.2 to 4.18.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.18.2...4.18.3) Updates `aio-pika` from 10.1.0 to 10.1.1 - [Release notes](https://github.com/mosquito/aio-pika/releases) - [Changelog](https://github.com/mosquito/aio-pika/blob/master/CHANGELOG.md) - [Commits](mosquito/aio-pika@10.1.0...10.1.1) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.143.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fastapi-minor-patch - dependency-name: asyncpg dependency-version: 0.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: fastapi-minor-patch - dependency-name: pymongo dependency-version: 4.18.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: fastapi-minor-patch - dependency-name: aio-pika dependency-version: 10.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: fastapi-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Owner
|
@dependabot rebase |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/pip/reference-apps/fastapi/fastapi-minor-patch-f0048616b7
branch
October 22, 2026 14:28
NormB
added a commit
that referenced
this pull request
Oct 22, 2026
… exceptions Dependency Scanning failed on every pull request from 2026-10-21 on, and on #374 it reported a vulnerability in a file Safety never read. Safety. The step printed "Known vulnerabilities" for any non-zero exit. Root cause: only exit 64 means vulnerabilities found; 67 and 68 mean the vulnerability database could not be loaded or fetched (Safety 3.8.1, safety/constants.py, measured). The loop moves to scripts/check-python-deps.sh, which reports 64 as a finding and any other non-zero code as "Could not check <file> (safety exit N)". Both still fail the job: an unchecked file is not a clean one. tests/test-check-python-deps.sh drives a stub safety through 0, 64, 67, 68 and a mixed run, and runs in the Test Suite workflow. Fault injection (64 -> 68, error branch not failing, exit code discarded) turned it red each time. Image scan. mysql:8.0.46 carries certifi 2026.2.25 (GHSA-6q48-6c7w-9gw2, fixed in 2026.10.19). Root cause: no mysql image has the fix yet; mysql:8.4.13 and mysql:9.7.4, published 2026-10-21, carry the same certifi, and the 8.0 line's last image is from 2026-05-05. Per the file's rule it gets a path-scoped exception, checked with Trivy 0.74.0: the gate counts 1 without it, 0 with it, and 1 again with a wrong path. The other exceptions expired 2026-10-31. Re-checked today: - CVE-2026-56854 (golang.org/x/crypto) is in no image any more: removed. - cadvisor moved to ghcr.io/google/cadvisor; the gcr.io image stops at v0.55.1, so Dependabot never offered a newer one. ghcr.io/google/cadvisor v0.60.6 scans clean, so compose uses it and its exception paths are gone. Boot-tested with the compose capabilities, mounts and device on arm64: the healthcheck passes and /metrics serves container series. - gosu (CVE-2025-68121) is still in the newest postgres, mongo and mysql tags; the four Vault entries are still in hashicorp/vault:1.21, last published 2026-03-05, while vault 2.2 scans clean (a major move, left to the open Vault pull request). Re-dated, expiring 2026-11-30. With the new file the image gate counts 0 CRITICAL over all 11 compose images. SERVICE_CATALOG.md and its wiki mirror name the new image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the fastapi-minor-patch group in /reference-apps/fastapi with 4 updates: fastapi, asyncpg, pymongo and aio-pika.
Updates
fastapifrom 0.142.2 to 0.143.0Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
f5c6e9b🔖 Release version 0.143.0 (#16477)182c8b8📝 Update release notesaf889e4💥 Require opt-in for automatic OpenTelemetry exporter setup (#16476)9269f17🔖 Release version 0.142.4 (#16471)78ede01📝 Update release notes4e31a07🐛 Isolate FastAPI telemetry for excluded requests (#16470)cb8dabc🔖 Release version 0.142.3 (#16469)787dc56📝 Update release notes6eae2f3🐛 Cache OpenTelemetry tracers to preserve warning deduplication (#16468)94918c1📝 Update release notesUpdates
asyncpgfrom 0.31.0 to 0.32.0Release notes
Sourced from asyncpg's releases.
... (truncated)
Commits
d701e11asyncpg v0.32.0b04f8f2Bump to macOS 26 in runners, set deployment target to 11 (#1384)3934d77tests: Capture expected pool retry warnings during role changes (#1383)2c37501tests: Avoid DeprecationWarning when settings up uvloop (#1382)b7eea79Test pool min_size backoff on target attribute mismatch (#1381)46dda91Terminate rejected target_session_attrs candidates before returning (#1380)8d2a5aeSupport PostgreSQL 19 (#1379)58c0c59Bump uvloop (#1378)67a1cbcMake pool min_size a maintained connection floor (#1323)25aaaf5fix: allow cursors in external transactions (#1350)Updates
pymongofrom 4.18.2 to 4.18.3Release notes
Sourced from pymongo's releases.
Changelog
Sourced from pymongo's changelog.
Commits
5479af6PYTHON-6155 Prep 4.18.3 release (#3108)bb8d4e1PYTHON-6110 Bound Regex element scans to the remaining document bytes (#3109)98f444bPYTHON-6140 [v4.18] [Build Failure] TestBSON.test_encode_size_limit MemoryErr...7376a3ePYTHON-6104 [v4.18] Remove mod_wsgi testing from Evergreen (#3091)dac0e76PYTHON-6083 [v4.18] Latest server binary downloads require private S3 (#3080)9ee37dfUpdate changelog to include CVEs (#3067)eda87d6BUMP 4.18.3.dev0Updates
aio-pikafrom 10.1.0 to 10.1.1Release notes
Sourced from aio-pika's releases.
Commits
39cc074Merge pull request #723 from mosquito/fix/broker-consumer-cancel7e5adfbRestore robust consumers after broker cancellation4f8b124Merge pull request #721 from mosquito/fix/pyinstaller-metadata360dd15Include package metadata in PyInstaller bundlesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions