Update dependency fastapi to v0.139.0#302
Conversation
renovate
Bot
requested review from
ValentaTomas,
jakubno and
mishushakov
as code owners
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Large 28-minor-version bump (0.111.0 → 0.139.0) with several documented breaking changes; worth a human confirming CI is green and the release notes were skimmed.
Extended reasoning...
Overview
Single-line change to template/server/requirements.txt, bumping fastapi==0.111.0 to fastapi==0.139.0. This is the sandbox server template — the FastAPI app in template/server/main.py that runs inside every E2B code-interpreter sandbox and exposes /execute, /contexts, /health endpoints consumed by the JS and Python SDKs.
Security risks
No direct security risk from the change itself. The version range does include a security-flavored change (v0.132.0 strict Content-Type checking) that hardens JSON parsing by default; both SDK clients already send Content-Type: application/json on POSTs, so this should be a net improvement rather than a regression.
Level of scrutiny
Elevated. A Renovate one-line bump is normally trivially approvable, but jumping 28 minor versions crosses several documented breaking changes: v0.132.0 (strict_content_type), v0.134.0 (Starlette bumped to >=0.46.0), v0.136.3 (no more underscore headers with convert_underscores=True), v0.137.0 (router.routes is no longer a flat list). The template code is straightforward standard FastAPI, so I don't see a concrete break, but the runtime blast radius is high — this ships to every sandbox.
Other factors
No bugs surfaced by the bug hunting system. No prior reviewer comments. No test exercise of this template file in the diff. Given the small textual change but high downstream impact, I'd rather a human confirm CI and eyeball the changelog than shadow-approve.
This PR contains the following updates:
==0.111.0→==0.139.0Release Notes
fastapi/fastapi (fastapi)
v0.139.0Compare Source
Features
app.frontend(), e.g. for automatic cookie authentication for the frontend. PR #15908 by @tiangolo.Translations
Internal
allow-unsafe-pr-checkout: true. PR #15876 by @YuriiMotov.v0.138.2Compare Source
Refactors
app.frontend()return 404 for methods other thanGETorHEADwith no static file matches. PR #15863 by @tiangolo.Internal
v0.138.1Compare Source
Refactors
Internal
v0.138.0Compare Source
Features
app.frontend("/", directory="dist")androuter.frontend("/", directory="dist"). PR #15800 by @tiangolo.Docs
app.frontend()instructions to Agent Library Skill. PR #15805 by @tiangolo.Translations
Internal
release-notes.mdfor typos. PR #15796 by @YuriiMotov.gpt-5.5model intranslate.py, specify-chatto avoid warnings. PR #15792 by @YuriiMotov.v0.137.2Compare Source
Features
iter_route_contexts()for advanced use cases that used to userouter.routes(e.g. Jupyverse). PR #15785 by @tiangolo.Translations
Internal
coverage.sh. PR #15772 by @tiangolo.v0.137.1Compare Source
Fixes
v0.137.0Compare Source
Breaking Changes
APIRouterandAPIRouteinstances. PR #15745 by @tiangolo.Unblocks ✨ SO MANY THINGS ✨
Before this,
router.include_router(other_router)would take each path operation fromother_routerand "clone" it, or recreate it from scratch.This would mean that in the end there was only one top level router, part of the app.
The way it is structured here is that there are a few additional classes to handle intermediate metadata for router and route inclusion. That way the information of "router X includes Y and Y includes Z" is stored somewhere, without affecting (recreating / clonning) the final route.
Non Objectives
Dependencies for 404: previously I intended to support dependencies that would be executed even for 404, but that would conflict with the fact that a router could not find a match, but the next router did find a match. Executing dependencies in the router that did not find a match would not make sense, they could consume the request, body, etc. This original idea was discarded.
Specific Breaking Changes
Now
router.routesis no longer a plain list ofAPIRouteobjects, it can contain these intermediate objects that can contain additional routers, forming a tree.Any logic that depended on iterating on the
router.routesdirectly would be affected, that logic cannot expect to be able to extract data from a plain list of routes, as it's no longer a plain list but a tree.Additionally, any logic that iterated on
router.routesto modify them would now also see these new objects, and would not see all the routes in the app.router.routesshould be considered an internal implementation detail, only passed around to the FastAPI functions that need it.Features
subrouterinmainroutercan be done before adding routes (path operations) tosubrouter, because now the the entire object is stored instead of copying the routes.Alpha Features
This is not documented yet, so it's not officially supported yet and could change in the future.
But, as
APIRouteandAPIRouterinstances are now preserved, they could be customized.APIRouterhas two new methods,.matches()and.handle(), counterpart to the existing ones inAPIRoute. With this a router could customize how it matches and handles requests. For example, it could match only requests that include some specific header, for example for handling versions in headers.Still, for now, consider this very experimental and potentially changing and breaking in the future.
Future Features Enabled
APIRoutesubclasses (undocumented, but alraedy works as desccribed above)APIRoutersubclasses (undocumented, but already works as described above)Docs
Annotatedin inline example indocs/en/docs/tutorial/body-multiple-params.md. PR #15591 by @TheArchons.docs/en/docs/tutorial/security/oauth2-jwt.md. PR #14781 by @zadevhub.Translations
Internal
changing_dirinstead ofCLIRunner.isolated_filesystemto set working dir. PR #15616 by @YuriiMotov.httpx2test dependency to avoid deprecation warning. PR #15603 by @YuriiMotov.v0.136.3Compare Source
Refactors
convert_underscores=True(the default). PR #15589 by @tiangolo.v0.136.1Compare Source
Upgrades
Internal
v0.136.0Compare Source
Upgrades
v0.135.4Compare Source
Refactors
@app.vibe()🤪. PR #15363 by @tiangolo.Internal
v0.135.3Compare Source
Features
@app.vibe(). PR #15280 by @tiangolo.Docs
client_secretin OAuth2 form docstrings. PR #14946 by @bysiber.Internal
lint.sh. PR #15136 by @svlandeg.v0.135.2Compare Source
Upgrades
pydantic >=2.9.0.and fix the test suite. PR #15139 by @svlandeg.Docs
pyproject.tomlwithentrypoint. PR #15075 by @tiangolo.target=_blankfor links in docs. PR #15063 by @tiangolo.max_digitsanddecimal_places. PR #14944 by @YuriiMotov.Translations
Internal
scripts/people.py. PR #15088 by @YuriiMotov.commit_in_placepassed via env variable intranslate.ymlworkflow. PR #15151 by @YuriiMotov.tyto precommit. PR #15091 by @svlandeg.v0.135.1Compare Source
Fixes
Docs
docs/en/docs/_llm-test.md. PR #15007 by @adityagiri3600.Internal
v0.135.0Compare Source
Features
v0.134.0Compare Source
Features
yield. PR #15022 by @tiangolo.>=0.40.0to>=0.46.0, as it's needed to properly unrwap and re-raise exceptions from exception groups.Docs
yield. PR #15023 by @tiangolo.awaitinStreamingResponsecode example to allow cancellation. PR #14681 by @casperdcl.docs_src/websocketstodocs_src/websockets_to avoid import errors. PR #14979 by @YuriiMotov.Internal
pytest-xdistandpytest-cov. PR #14992 by @YuriiMotov.v0.133.1Compare Source
Features
Internal
v0.133.0Compare Source
v0.132.1Compare Source
Refactors
Internal
benchmarkjob intestworkflow. PR #14974 by @YuriiMotov.v0.132.0Compare Source
Breaking Changes
strict_content_typechecking for JSON requests. PR #14978 by @tiangolo.Content-Typeheader with a valid JSON value, likeapplication/json, and rejects requests that don't.Content-Typeheader you can disable this withstrict_content_type=False.Internal
griffelibinstead ofgriffe. PR #14973 by @svlandeg.FastAPI Peopleworkflow. PR #14951 by @YuriiMotov.v0.131.0[Compare Source](https://re
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.