fix: bump fastapi and uvicorn to patch security vulnerabilities (#278)

[meruedoro]

Summary

Fixes #278 — resolves 33 known CVEs in Python dependencies by bumping hard-pinned versions to minimum-version floors.

Root Cause

pyproject.toml hard-pinned fastapi==0.111.0 and uvicorn==0.29.0, which forced the resolver to pull in vulnerable transitive dependencies — most critically starlette 0.37.2 (CVE-2024-47874, CVSS 8.7 HIGH: DoS via multipart/form-data parsing).

Changes

File	Change
packages/pybackend/pyproject.toml	fastapi==0.111.0 → fastapi>=0.115.0
packages/pybackend/pyproject.toml	uvicorn==0.29.0 → uvicorn>=0.30.0
packages/pybackend/uv.lock	Regenerated (resolves fastapi 0.135.1, starlette 0.52.1, uvicorn 0.42.0)

Key CVE Addressed

• CVE-2024-47874 (HIGH 8.7) — Denial of Service in starlette <0.40.0 multipart form-data handling. Fixed by starlette ≥0.40.0 (resolved: 0.52.1).

Why minimum floors instead of exact pins

Switching from == to >= lets the resolver pick the latest compatible release while guaranteeing a minimum patched version. This avoids re-creating the same problem when new patches are released upstream.

Testing

• uv sync resolves cleanly (34 packages, 32 audited)
• Unit tests pass (200/200 in tests/unit/, excluding test_api.py which requires Linux-only fcntl)
• CI will validate on Ubuntu as usual

[vercel]

Someone is attempting to deploy a commit to the Tom Brandenburg's projects Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Pull request overview

This PR updates the Python backend dependency constraints to address known security vulnerabilities by moving FastAPI and Uvicorn from hard pins to minimum-version floors, and regenerating the uv.lock accordingly.

Changes:

• Relax fastapi from ==0.111.0 to >=0.115.0.
• Relax uvicorn from ==0.29.0 to >=0.30.0.
• Regenerate packages/pybackend/uv.lock to resolve newer patched transitive dependencies (notably Starlette).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
packages/pybackend/pyproject.toml	Switches FastAPI/Uvicorn constraints from exact pins to minimum floors for security patch uptake.
packages/pybackend/uv.lock	Lockfile regeneration reflecting the new resolution set (FastAPI/Starlette/Uvicorn and transitive changes).

---

You can also share your feedback on Copilot code review. Take the survey.

[meruedoro]

Good catch — updated to uvicorn[standard]>=0.30.0 in 52b2c0c. The lockfile now includes websockets, httptools, watchfiles, python-dotenv, and uvloop as expected.