Skip to content

build(deps): update fastapi requirement from >=0.141.1 to >=0.146.0 - #3636

Merged
PetrefiedThunder merged 4 commits into
mainfrom
dependabot/pip/fastapi-gte-0.146.0
Oct 28, 2026
Merged

build(deps): update fastapi requirement from >=0.141.1 to >=0.146.0#3636
PetrefiedThunder merged 4 commits into
mainfrom
dependabot/pip/fastapi-gte-0.146.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fastapi to permit the latest version.

Release notes

Sourced from fastapi's releases.

0.146.0

The root_path parameter in FastAPI() is deprecated. Configure the server with fastapi run --root-path /api/v1 instead.

Breaking Changes

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): update fastapi requirement from >=0.141.1 to >=0.146.0
a2d33d8 
Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version.
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.146.0)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.146.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added backend dependencies Pull requests that update a dependency file labels Oct 26, 2026
@vercel

vercel Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
regengine Ignored Ignored Preview Oct 28, 2026 4:31am UTC

Request Review

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Regenerated requirements.lock with CI's toolchain (pip 24.3.1, pip-tools 7.5.2, Python 3.11), pinned to the versions this PR proposes. Backend CI and security were re-dispatched on the new head — wait for them to go green before merging.

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

PR Blocker Checklist

Head SHA: b84a9c16123e2429d3093a91129cfbfb103bf23f

Status: Ready

  • All review threads resolved
  • No reviews requesting changes
  • No blocked review engines

@PetrefiedThunder
merge: bring main into dependabot fastapi>=0.146.0 (#3636)
45a4efe
@PetrefiedThunder
fix: bump authlib>=1.9.1 and dnspython>=2.9.0 for CVEs
b84a9c1 
Security/Dependency Audit fails after merging main: pip-audit
flags authlib 1.8.0 and dnspython 2.8.0. Floor both packages
and regenerate the hashed lock with the CI pip-tools toolchain.

Signed-off-by: Christopher Sellers <1@christophersellers.com>
@PetrefiedThunder

PetrefiedThunder commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

REVIEW: PASS hermes b84a9c1

Read the full diff at this head: fastapi 0.141.1 to 0.146.0 plus the authlib>=1.9.1 / dnspython>=2.9.0 CVE floor bump, with requirements.lock regenerated and hashed. All CI checks pass except Engine Review Pass (fails on the Dependabot branch prefix, not code) and the Head SHA Check Guard / PR Blocker Checklist runs, which were cancelled by workflow concurrency rather than failing a step.

FastAPI breaking notes in that range, checked against the repo at this head:

  • 0.145.0 removes openapi_prefix and unused **extra kwargs from FastAPI(). Every FastAPI(...) constructor (server/main.py, services/{admin,compliance,graph,ingestion,nlp}/main.py, scripts/jev_lab/server.py) passes only standard kwargs (title, description, version, lifespan, contact, docs_url, redoc_url, openapi_url). Nothing uses openapi_prefix.
  • 0.146.0 deprecates the root_path constructor parameter. The only root_path uses in the repo are ASGI scope dicts in tests and a local variable in services/shared/rules/evaluators/stateless.py, not the constructor argument.
  • 0.143.0 makes FastAPI's own OTel exporter auto-setup opt-in. That's a non-issue here: 0.141.1 predated native OTel (added in 0.142.0), and the repo instruments through opentelemetry-instrumentation-fastapi.
  • The rest (0.142.x to 0.144.0) is bug fixes plus WebSocket support in security dependencies.

authlib 1.9.x is security hardening and has no direct imports in the repo. dnspython 2.9.0 fixes GHSA-45c3-73f7-pv4m and needs Python >= 3.11, which matches the lock's Python 3.11. All service test suites, tenant isolation and the security audits are green.

@PetrefiedThunder
PetrefiedThunder merged commit 70e7e8e into main Oct 28, 2026
92 of 96 checks passed
@PetrefiedThunder
PetrefiedThunder deleted the dependabot/pip/fastapi-gte-0.146.0 branch October 28, 2026 07:13
@PetrefiedThunder PetrefiedThunder mentioned this pull request Oct 28, 2026
Closed
PetrefiedThunder added a commit that referenced this pull request Oct 28, 2026
@PetrefiedThunder @claude
fix(domains): use regengine.co instead of third-party RegEngine domai…
0c2cde5 
…ns (#3679)

regengine.ai and regengine.dev are live third-party sites and regengine.com is a third party's; the repo used them in docs, example config and running code. Replace with regengine.co: label QR default (TRACEABILITY_DOMAIN), agent inbox addresses, crawler User-Agent strings, snapshot fallback email, plus docs and .env.example. Add tests/invariants/test_no_third_party_regengine_domains.py as a drift guard.

Reviewed by Muse (PASS) and a five-lens adversarial verification (no blocking findings). CI green on required checks after the authlib/dnspython lock fix landed on main via #3636. Merged at Christopher's direction, 2026-10-28.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PetrefiedThunder PetrefiedThunder Awaiting requested review from PetrefiedThunder PetrefiedThunder is a code owner

Assignees

No one assigned

Labels

backend dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PetrefiedThunder