[devin-ai-integration]

Summary

template/server/requirements.txt pinned fastapi==0.111.0, which pulls in Starlette 0.37.2 (CVE-2024-47874, fixed in 0.40.0). This bumps the interpreter server to:

fastapi==0.111.0            → fastapi==0.162.0
                            + starlette==1.10.0   (fastapi only requires `starlette>=0.46.0`, so pin it explicitly)
uvicorn[standard]==0.30.1   → uvicorn[standard]==0.54.0
websockets==12.0            → websockets==17.3    (uvicorn[standard]>=0.53 requires websockets>=13)

Why the three have to move together

Kernel interrupts on client disconnect (#213, ContextWebSocket.execute) rely on Starlette cancelling the streaming body generator (CancelledError/GeneratorExit), which then calls interrupt() on the Jupyter kernel. Starlette ≥ 0.42 picks the code path by the ASGI spec_version the server reports:

# starlette/responses.py StreamingResponse.__call__
if spec_version >= (2, 4):
    await self.stream_response(send)     # relies on send() raising OSError; no listen_for_disconnect
else:
    ... task group with listen_for_disconnect → cancels body_iterator on http.disconnect

uvicorn 0.30.1 reports spec_version: "2.4" but its send() silently returns on a disconnected client, so with a new Starlette the body generator is never cancelled, the timed-out cell keeps running in the kernel and every later cell in that context queues behind it (this is why the Renovate bumps #207/#302 fail CI). uvicorn 0.32.1 dropped the scope back to spec_version: "2.3" (Kludex/uvicorn#2513), which restores the cancellation path — no server code change needed.

Verified locally with a minimal FastAPI streaming app + client that disconnects after 2s:

fastapi / starlette / uvicorn	generator cancelled on disconnect
0.111.0 / 0.37.2 / 0.30.1 (current)	yes (CancelledError)
0.162.0 / 1.10.0 / 0.30.1	no
0.162.0 / 1.10.0 / 0.54.0 (this PR)	yes (CancelledError)

websockets

messaging.py uses the legacy websockets.client.unix_connect/WebSocketClientProtocol API. It still works on 17.3 (emits a DeprecationWarning, which the default filters hide outside __main__) and websockets commits to maintaining it until November 2029, so migrating to websockets.asyncio is left for a follow-up.

Release

Includes a patch changeset for @e2b/code-interpreter-template, so merging triggers the template rebuild/publish via release.yml. The PR CI builds a test template and runs tests/ (incl. test_interrupt.py::test_subsequent_execution_works_after_client_timeout) against it.

Supersedes #278 and #302.

Link to Devin session: https://app.devin.ai/sessions/943dbceafe0f4e0a91bc044363751b97
Open in Devin Desktop: https://app.devin.ai/desktop/session/943dbceafe0f4e0a91bc044363751b97?variant=devin
Requested by: @mishushakov

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T12:39:11.856919Z	7d5965c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Besides the inline finding, I checked the server for Starlette 1.x removals and found nothing affected. main.py registers startup through FastAPI(lifespan=...) rather than the removed on_event/on_startup hooks, and stream.py only imports starlette.background.BackgroundTask, which Starlette 1.x still provides.

Extended reasoning...

The change only bumps dependency pins in template/server/requirements.txt and adds a patch changeset. The server's Starlette usage (lifespan handler, BackgroundTask) was checked against the 1.x removals and is not affected.