Skip to content

chore(deps): bump fastapi and starlette lock - #3043

Open
dokterbob wants to merge 2 commits into
mainfrom
chore/bump-fastapi-lock
Open

dokterbob wants to merge 2 commits into
mainfrom
chore/bump-fastapi-lock

Conversation

@dokterbob

@dokterbob dokterbob commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Refreshes uv.lock to pull in the latest fastapi (0.123.5 -> 0.141.1) and starlette (0.50.0 -> 1.6.0) releases via uv lock -P fastapi -P starlette
  • No pyproject.toml constraint changes needed (both deps use unbounded >= lower pins)

Test plan

  • uv run pytest --cov=chainlit/ — 932 passed
  • uv run scripts/type_check.py — no issues found

🤖 Generated with Claude Code

https://claude.ai/code/session_0113KUXq5rCWWo6wWeMCKPi1


Summary by cubic

Refreshes uv.lock for fastapi (0.123.5 → 0.141.1) and starlette (0.50.0 → 1.6.0), and fixes the e2e auth test for the new FastAPI routing behavior.

  • Both deps use unbounded >= pins, so pyproject.toml is unchanged; verified with 932 passing tests and the type checker.
  • FastAPI ≥ 0.141 no longer flattens include_router into app.routes, so the old catch-all relocation crashed; the e2e test now moves the custom auth routes to the front of app.routes instead.

Written for commit d09191c. Summary will update on new commits.

Review in cubic

Refreshes the uv lockfile to pull in the latest fastapi (0.123.5 -> 0.141.1)
and starlette (0.50.0 -> 1.6.0) releases. Verified with the full backend
test suite and type checker.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0113KUXq5rCWWo6wWeMCKPi1

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Re-trigger cubic

fastapi >= 0.141 no longer flattens app.include_router(router) into
app.routes — it appends a single _IncludedRouter wrapper with no .path
attribute, so the old catch-all lookup crashed. Recursing into the
wrapper wouldn't help either, since it still reports a full route
match for any path the catch-all matches.

Move the two directly-added custom routes to the front of app.routes
instead of relocating the catch-all. This is version-agnostic: it
works whether the catch-all lives at the top level or nested inside
an _IncludedRouter, regardless of fastapi/starlette internals.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0113KUXq5rCWWo6wWeMCKPi1
@dokterbob
dokterbob enabled auto-merge September 9, 2026 16:01
@dokterbob dokterbob self-assigned this Sep 9, 2026
@dokterbob dokterbob added review-me Ready for review! security labels Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review-me Ready for review! security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant