From ecad7d87bf46c8045e454b8f8fdbc135c90a3df4 Mon Sep 17 00:00:00 2001 From: Daniel Vejsada Date: Thu, 15 Oct 2026 07:41:54 +0200 Subject: [PATCH 1/2] fix(security): bump FastAPI to 0.133.0 and pin Starlette 1.7.0 fastapi 0.115.12 capped starlette<0.47, holding the lite image on three fixable HIGH CVEs: CVE-2025-62727 (fixed 0.49.1), CVE-2026-48818 (fixed 1.1.0) and CVE-2026-54283 (fixed 1.3.1). 0.133.0 is the oldest FastAPI that drops the <1.0 cap ("Add support for Starlette 1.0.0+"). Since it no longer bounds Starlette, pin it explicitly to 1.7.0 (no advisories after 1.3.1; the version FastAPI's own CI moved to). Starlette 1.0 removed on_startup/on_shutdown, on_event, and the Starlette-level route/middleware/exception_handler decorators. The app already uses lifespan, and app.middleware/app.exception_handler are FastAPI's own methods, so no code changes are needed. uvicorn 0.28.0 and httpx 0.28.1 (TestClient) work unchanged; anyio resolves to 4.x as Starlette 1.7 requires. Verified in Dockerfile.lite: 385 passed / 1 skipped, and Trivy reports 0 fixable CRITICAL/HIGH. Co-Authored-By: Claude Opus 5.5 --- requirements.lite.txt | 3 ++- requirements.txt | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/requirements.lite.txt b/requirements.lite.txt index 6a0c7f02..2577f07b 100644 --- a/requirements.lite.txt +++ b/requirements.lite.txt @@ -5,7 +5,8 @@ langchain-core==1.4.8 langchain-google-genai==4.2.5 sqlalchemy==2.0.41 python-dotenv==1.2.2 -fastapi==0.115.12 +fastapi==0.133.0 +starlette==1.7.0 # >=1.3.1 for CVE-2025-62727, CVE-2026-48818, CVE-2026-54283; fastapi no longer caps it psycopg2-binary==2.9.9 pgvector==0.2.5 uvicorn==0.28.0 diff --git a/requirements.txt b/requirements.txt index e77f4368..87024f3b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,7 +7,8 @@ langchain-text-splitters==1.1.2 boto3==1.43.48 sqlalchemy==2.0.41 python-dotenv==1.2.2 -fastapi==0.115.12 +fastapi==0.133.0 +starlette==1.7.0 # >=1.3.1 for CVE-2025-62727, CVE-2026-48818, CVE-2026-54283; fastapi no longer caps it psycopg2-binary==2.9.9 pgvector==0.2.5 uvicorn==0.28.0 From f0d5fb59de3bcfcad67784f40551fdbffbcdb65b Mon Sep 17 00:00:00 2001 From: Daniel Vejsada Date: Thu, 15 Oct 2026 08:01:43 +0200 Subject: [PATCH 2/2] chore(deps): move to FastAPI 0.143.1; bump mistralai to 2.10.1 0.133.0 was only the oldest FastAPI without the starlette<1.0 cap. It shipped before Starlette 1.0 final and was never tested upstream against the pinned starlette 1.7.0, which FastAPI 0.142.3+ CI runs against. Nothing in 0.134-0.143 affects this app: the router-tree refactor (0.137) only matters to code reading router.routes (none here), and the native OpenTelemetry support (0.142) has exporter setup opt-in since 0.143. fastapi>=0.142 requires opentelemetry-api>=1.44, which mistralai 2.6.0 blocked through its opentelemetry-semantic-conventions<0.61 cap. 2.10 drops that cap. The 2.7-2.10.1 breaking changes are limited to the evaluations/workflows/campaigns APIs, not OCR. Verified in Dockerfile.lite: pip check clean, 385 passed / 1 skipped, Trivy 0 fixable CRITICAL/HIGH. Also ran a smoke test of the real mistralai 2.10.1 OCR surface (Mistral(server_url=...), ocr.process with document_url/image_url, response .pages[].markdown) against a mocked transport, since the unit tests stub the SDK. Co-Authored-By: Claude Opus 5.5 --- requirements.lite.txt | 4 ++-- requirements.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.lite.txt b/requirements.lite.txt index 2577f07b..d617ab27 100644 --- a/requirements.lite.txt +++ b/requirements.lite.txt @@ -5,7 +5,7 @@ langchain-core==1.4.8 langchain-google-genai==4.2.5 sqlalchemy==2.0.41 python-dotenv==1.2.2 -fastapi==0.133.0 +fastapi==0.143.1 starlette==1.7.0 # >=1.3.1 for CVE-2025-62727, CVE-2026-48818, CVE-2026-54283; fastapi no longer caps it psycopg2-binary==2.9.9 pgvector==0.2.5 @@ -39,4 +39,4 @@ chardet==5.2.0 langchain-ollama==1.1.0 tenacity==9.1.4 msoffcrypto-tool==6.0.0 -mistralai==2.6.0 +mistralai==2.10.1 # >=2.10 drops the opentelemetry-semantic-conventions<0.61 cap that conflicts with fastapi>=0.142 diff --git a/requirements.txt b/requirements.txt index 87024f3b..0d2eab37 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,7 +7,7 @@ langchain-text-splitters==1.1.2 boto3==1.43.48 sqlalchemy==2.0.41 python-dotenv==1.2.2 -fastapi==0.133.0 +fastapi==0.143.1 starlette==1.7.0 # >=1.3.1 for CVE-2025-62727, CVE-2026-48818, CVE-2026-54283; fastapi no longer caps it psycopg2-binary==2.9.9 pgvector==0.2.5 @@ -45,4 +45,4 @@ pydantic==2.13.4 chardet==5.2.0 tenacity==9.1.4 msoffcrypto-tool==6.0.0 -mistralai==2.6.0 +mistralai==2.10.1 # >=2.10 drops the opentelemetry-semantic-conventions<0.61 cap that conflicts with fastapi>=0.142