Bump fastapi to >=0.136.3 for Python >= 3.10 to fix PYSEC-2026-161

Signed-off-by: Ha Vu <ha@newmantle.tech>

Author: hongha912

pyproject.toml

@@ -134,15 +134,19 @@ snowflake = [
 starrocks = ["pymysql"]
 trino = ["trino"]
 web = [
-    "fastapi==0.120.1",
+    # fastapi>=0.136.3 brings in starlette>=1.0.1, which fixes PYSEC-2026-161.
+    # Both require Python >= 3.10, so 3.9 stays on the previous pin.
+    "fastapi>=0.136.3; python_version >= '3.10'",
+    "fastapi==0.120.1; python_version < '3.10'",
     "watchfiles>=0.19.0",
     "uvicorn[standard]==0.22.0",
     "sse-starlette>=0.2.2",
     "pyarrow",
 ]
 lsp = [
     # Duplicate of web
-    "fastapi==0.120.1",
+    "fastapi>=0.136.3; python_version >= '3.10'",
+    "fastapi==0.120.1; python_version < '3.10'",
     "watchfiles>=0.19.0",
     # "uvicorn[standard]==0.22.0",
     "sse-starlette>=0.2.2",

web/server/settings.py

@@ -96,7 +96,7 @@ def get_path_to_model_mapping(
 
 def get_loaded_context(
     settings: Settings = Depends(get_settings),
-) -> t.Generator[Context, None]:
+) -> t.Generator[Context, None, None]:
     try:
         with get_loaded_context_lock:
             yield _get_loaded_context(settings.project_path, settings.config, settings.gateway)