build: bump fastapi and starlette pins in openai frontend - #8940
Merged
Conversation
mc-nv
added
Build
mc-nv
marked this pull request as ready for review
August 26, 2026 15:35
mc-nv
requested review from
Vinya567,
dmitry-tokarev-nv,
nv-rinig,
whoisj and
yinggeh
August 26, 2026 15:36
Greptile SummaryThis PR updates the OpenAI frontend’s coupled FastAPI and Starlette constraints to admit the Starlette security-fix release while remaining within vLLM’s FastAPI range.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (2): Last reviewed commit: "build: bump fastapi and starlette pins i..." | Re-trigger Greptile |
whoisj
previously approved these changes
Aug 26, 2026
fastapi 0.121.2 capped starlette<0.50.0, blocking the starlette 1.x floor. Move fastapi to 0.136.3, the newest release inside vllm's fastapi[standard]<0.137.0,>=0.133.0 window, and raise starlette to >=1.3.1,<2. Verified in tritonserver 26.08-py3-stage and 26.07-vllm-python-py3-stage: pip resolves to fastapi 0.136.3 / starlette 1.6.0, pip check reports no fastapi or starlette conflicts, and the openai frontend test suite is unchanged from baseline (25 passed, 8 pre-existing environment errors). (cherry picked from commit aa33708) (cherry picked from commit a939910) (cherry picked from commit 32d1677)
mc-nv
force-pushed
the
mchorny/TRI-1736/bump-fastapi-starlette-pins
branch
from
August 26, 2026 16:13
32d1677 to
a6eaf27
Compare
mc-nv
changed the base branch from
mchorny/TRI-1736/enable-token-based-authorization-for-github
to
main
August 26, 2026 16:14
whoisj
approved these changes
Aug 26, 2026
20 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does the PR do?
Bumps the fastapi and starlette pins in the openai frontend.
starlettemoves to>=1.3.1,<2to pick up the CVE fix. That floor cannot bemet by the pinned fastapi, because releases before 0.133.0 cap starlette below
1.0, so
fastapimoves to0.136.3. The upper bound stays below 0.137.0because vllm requires
fastapi[standard]<0.137.0,>=0.133.0. The two pins arecoupled, which is why they move together.
Checklist
<commit_type>: <Title>Commit Type:
Check the conventional commit type
box here and add the label to the github PR.
Related PRs:
Where should the reviewer start?
python/openai/requirements.txt— the fastapi upper bound and the starlettefloor, and whether the vllm constraint still holds.
Test plan:
Caveats:
The fastapi bound is dictated by vllm's own requirement range, so a future vllm
bump may need this revisited.
Background
Split out of #8939, which carried this commit
alongside unrelated build-secret work. Separating it keeps that PR to a single
concern. The two are independent and can merge in either order.
Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)