Upgrade starlette and FastAPI

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2024.1]
+
+### Changed
+
+- Upgrade starlette and FastAPI to 0.36.3 and 0.109.2 respectively in [#186](https://github.com/microsoft/planetary-computer-apis/pull/186)
+
 ## [2023.2]
 
 ### Changed

pccommon/setup.py

@@ -5,6 +5,8 @@
 # Runtime requirements.
 inst_reqs = [
     "fastapi==0.90.1",
+    # Version override by pip install in Dockerfiles to address CVE.
+    # Cannot do it here due to unnecessary pip version constraints in FastAPI.
     "starlette>=0.22.0,<0.23.0",
     "opencensus-ext-azure==1.0.8",
     "opencensus-ext-logging==0.1.0",

pcstac/Dockerfile

@@ -11,6 +11,9 @@ COPY pcstac /opt/src/pcstac
 COPY pccommon /opt/src/pccommon
 RUN pip install -r ./pcstac/requirements.txt -e ./pccommon -e ./pcstac[server]
 
+# Override starlette version
+RUN /bin/sh -c "python -m pip install --upgrade --force-reinstall starlette==0.27.0"
+
 ENV APP_HOST=0.0.0.0
 ENV APP_PORT=81
 

pcstac/Dockerfile.dev

@@ -4,3 +4,4 @@ COPY requirements-dev.txt requirements-dev.txt
 RUN pip install -r requirements-dev.txt
 
 RUN pip install -e ./pccommon[dev] -e ./pcstac
+RUN /bin/sh -c "python -m pip install --upgrade --force-reinstall starlette==0.27.0"

pcstac/requirements.txt

@@ -265,7 +265,7 @@ termcolor==2.3.0
     # via fire
 types-cachetools==4.2.9
     # via pccommon (pccommon/setup.py)
-typing-extensions==4.6.3
+typing-extensions==4.9.0
     # via
     #   asgiref
     #   azure-core

pctiler/Dockerfile

@@ -33,6 +33,9 @@ COPY pctiler /opt/src/pctiler
 # Install the local modules in the new environment
 RUN /bin/sh -c "python -m pip install --no-cache-dir -e ./pccommon -e ./pctiler[server]"
 
+# Override starlette version
+RUN /bin/sh -c "python -m pip install --upgrade --force-reinstall starlette==0.27.0"
+
 # GDAL config
 ENV GDAL_CACHEMAX 200
 ENV GDAL_INGESTED_BYTES_AT_OPEN 32768

pctiler/Dockerfile.dev

@@ -4,3 +4,4 @@ COPY requirements-dev.txt requirements-dev.txt
 
 RUN python3 -m pip install -r requirements-dev.txt
 RUN python3 -m pip install -e ./pccommon -e ./pctiler[dev]
+RUN /bin/sh -c "python -m pip install --upgrade --force-reinstall starlette==0.27.0"