Skip to content

Commit d3bec03

Browse files
vvillait88vvillait88
committed
security: pin fastapi off malicious 0.136.3 (MAL-2026-4750)
fastapi 0.136.3 is a compromised release that injects an undocumented `fastar` typosquat dependency (code-execution vector; AWS Inspector, 2026-05-23). Add a uv constraint-dependency `fastapi!=0.136.3`; resolves to clean 0.136.1.
1 parent 47d614a commit d3bec03

2 files changed

Lines changed: 10 additions & 3 deletions

File tree

‎pyproject.toml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,3 +107,7 @@ filterwarnings = [
107107

108108
[tool.uv]
109109
required-version = ">=0.11.0"
110+
# fastapi 0.136.3 is a malicious release (MAL-2026-4750): it injects an
111+
# undocumented `fastar` typosquat dependency. Pin away from it until a clean
112+
# release supersedes it on PyPI.
113+
constraint-dependencies = ["fastapi!=0.136.3"]

‎uv.lock‎

Lines changed: 6 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)