Skip to content
This repository has been archived by the owner on Feb 27, 2024. It is now read-only.

Bump starlette from 0.25.0 to 0.27.0 #28

Merged
merged 3 commits into from Jun 1, 2023
Merged

Conversation

pavsorab
Copy link
Contributor

@pavsorab pavsorab commented Jun 1, 2023

Changes :

  • Upgrade starlette version from 0.25.0to 0.27.0
  • fastapi is now at 0.95.2 for supporting starlette 0.27.0
  • Added h11>=0.13.0 because httpcore 0.17.2 requires h11<0.15,>=0.13
  • Added request_body to get the request body directly to allow non-JSON data
  • Made changes to tests/unit_tests/test_microservice.py for passing Content-Type as text/plain
  • In Swagger UI, users can now enter the body for the request

For performing post requests with request body we must strictly pass headers with Content-Type as text/plain for the request to work. This is to prevent CSRF in FastAPI as mentioned here tiangolo/fastapi#3456 and GHSA-8h2j-cgx8-6xv7

To allow request Body to parse as non-JSON based on media_type the issue is ongoing in tiangolo/fastapi#9159

Fixes #26

Fixes https://github.com/vmware-labs/build-inspector/security/dependabot/5

Pavan Sorab added 3 commits June 1, 2023 19:58
Signed-off-by: Pavan Sorab <psorab@vmware.com>
Signed-off-by: Pavan Sorab <psorab@vmware.com>
Signed-off-by: Pavan Sorab <psorab@vmware.com>
@loredous loredous merged commit 8967be9 into main Jun 1, 2023
13 checks passed
@loredous loredous deleted the bump-version-starlette-0.27 branch June 8, 2023 18:42
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add proper hinting to show Swagger that the findings/dependencies/report endpoints take a body value
2 participants