Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update to FastAPI 0.115.5 and Starlette 0.41
This commit will update/upgrade to [FastAPI 0.115.5](https://fastapi.tiangolo.com/release-notes/) and [Starlette 0.41](https://www.starlette.io/release-notes/). FastAPI 0.115.3 updated Starlette to `"starlette>=0.40.0,<0.42.0"`. Changes to Starlette between 0.39 and 0.41 include a fix for a DoS (Denial of Service) security vulnerability released in Starlette 0.40.0 ([GHSA-f96h-pmfr-66vw](GHSA-f96h-pmfr-66vw)). FastAPI has been repeatedly updating the minor version of Starlette in patch releases of FastAPI. Previously, inboard pinned FastAPI to the minor version (like `"fastapi>=0.115,<0.116"`), allowing patch version updates whenever the inboard project was installed. Unfortunately, it can result in version incompatibilities when FastAPI updates the Starlette minor version unexpectedly like this. For example, the inboard `pyproject.toml` previously specified `"fastapi>=0.115,<0.116"` and `"starlette>=0.37.2,<0.39.0"`. With the release of FastAPI 0.115.3, those two version specifiers are incompatible. It would be simpler if FastAPI released a minor version each time it updated the minor version of Starlette. As a stopgap, this commit will pin the FastAPI version exactly (`"fastapi==0.115.5"`) so the versions of FastAPI and Starlette do not become unexpectedly incompatible. This of course means inboard will need to provide updates to FastAPI more frequently (for patch releases instead of for minor releases). As usual, the lack of attention to release practices in the open source community means more maintenance work for the inboard maintainer.
- Loading branch information