From 7d5965c3c5f33c6993f7e1c5e1dd99fde2163a3a Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 12:34:22 +0000 Subject: [PATCH] fix(template): upgrade fastapi, starlette and uvicorn together Starlette 0.37.2 (pulled in by fastapi==0.111.0) is affected by CVE-2024-47874. Upgrading Starlette alone breaks kernel interrupts on client disconnect: uvicorn 0.30.1 advertises ASGI spec 2.4 without raising on writes to a closed connection, so Starlette >= 0.42 never cancels the streaming body. uvicorn >= 0.32.1 reports spec 2.3 again, restoring the cancellation path. uvicorn[standard] >= 0.53 needs websockets >= 13, so websockets is bumped as well; the legacy client API the server uses is supported until 2029. Co-Authored-By: mish@e2b.dev --- .changeset/bump-fastapi-starlette-uvicorn.md | 5 +++++ template/server/requirements.txt | 7 ++++--- 2 files changed, 9 insertions(+), 3 deletions(-) create mode 100644 .changeset/bump-fastapi-starlette-uvicorn.md diff --git a/.changeset/bump-fastapi-starlette-uvicorn.md b/.changeset/bump-fastapi-starlette-uvicorn.md new file mode 100644 index 00000000..06236e28 --- /dev/null +++ b/.changeset/bump-fastapi-starlette-uvicorn.md @@ -0,0 +1,5 @@ +--- +'@e2b/code-interpreter-template': patch +--- + +Upgrade the interpreter server to `fastapi==0.162.0` (Starlette 1.10.0), `uvicorn[standard]==0.54.0` and `websockets==17.3`. The previous `fastapi==0.111.0` pin pulled in Starlette 0.37.2, which is affected by CVE-2024-47874. Upgrading Starlette alone would break kernel interrupts on client disconnect (`run_code` timeouts): uvicorn 0.30.1 advertises ASGI spec 2.4 without raising on writes to a closed connection, so Starlette >= 0.42 never cancels the streaming body and the timed-out cell keeps running in the kernel; uvicorn >= 0.32.1 reports spec 2.3 again, so disconnects cancel the stream and the kernel is interrupted. diff --git a/template/server/requirements.txt b/template/server/requirements.txt index 6d99e0d8..e5c29734 100644 --- a/template/server/requirements.txt +++ b/template/server/requirements.txt @@ -1,7 +1,8 @@ -fastapi==0.111.0 +fastapi==0.162.0 +starlette==1.10.0 httpx==0.28.1 -websockets==12.0 -uvicorn[standard]==0.30.1 +websockets==17.3 +uvicorn[standard]==0.54.0 requests==2.33.0 pydantic==2.9.1 certifi==2026.10.19