sec: relax fastapi upper bound + floor-pin tornado (CVE-2025-62727, CVE-2026-31958)#289

Open

scale-ballen wants to merge 13 commits intomainfrom

sec/relax-fastapi-bound-fix-tornado

Commits on Mar 23, 2026

sec: relax fastapi upper bound, floor-pin tornado to fix 2 HIGH CVEs

scale-ballen
and
claude
committed
fix(tests): update test payloads to match current *Params model schema

scale-ballen
and
claude
committed
fix: cap starlette<1.0.0 to avoid BaseHTTPMiddleware streaming regression

scale-ballen
and
claude
committed
fix: replace BaseHTTPMiddleware with pure ASGI middleware to fix streaming

scale-ballen
and
claude
committed
fix: sort imports in base_acp_server to satisfy ruff isort

scale-ballen
and
claude
committed
fix: restore original import order to satisfy ruff isort

scale-ballen
and
claude
committed
fix: remove starlette<1.0.0 cap now that BaseHTTPMiddleware is gone

scale-ballen
and
claude
committed
fix: add temporalio[opentelemetry] extra to resolve ModuleNotFoundError

scale-ballen
and
claude
committed
fix: replace fastacp uuid import with stdlib import in tutorial tests

scale-ballen
and
claude
committed
fix: replace temporalio[opentelemetry] extra with explicit opentelemetry deps

scale-ballen
and
claude
committed
fix: remove private _JSONTypeConverterUnhandled import from worker.py

scale-ballen
and
claude
committed
fix: add current user message to input_list and fix langgraph model in sync tutorials

scale-ballen
and
claude
committed
fix: use built SDK wheel for tutorial tests and fix tutorial agent bugs

scale-ballen
and
claude
committed