[prediction] fastapi<=0.124.4 cap blocks patched Starlette (CVE-2026-48710 / BadHost, CISA KEV)
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
Research direction
Look at the dependency declarations in setup.py or pyproject.toml for the 'prediction', 'full', and 'testing' extras. The issue is about updating the FastAPI version constraint to >=0.133.0 to allow a patched Starlette (>=1.0.1). Check how Custom Prediction Routines (CPR) are built in LocalModel.build_cpr_model to understand the impact. After updating the version bounds, run pip check to ensure no conflicts and test the build process for a CPR container.
Written by the indexing model from the issue text.
Description
The prediction, full and testing extras in google-cloud-aiplatform 2.2.0 declare fastapi>=0.71.0,<=0.124.4. FastAPI 0.124.4 requires starlette>=0.40.0,<0.51.0, so these extras cannot resolve to a Starlette version patched for CVE-2026-48710 (GHSA-86qp-5c8j-p5mr), fixed in starlette>=1.0.1. The CVE was added to CISA's KEV catalog in September 2026.
This affects Custom Prediction Routines: LocalModel.build_cpr_model installs google-cloud-aiplatform[prediction] in the image, so every CPR container ships a vulnerable Starlette unless users override it in requirements.txt, which produces a declared dependency conflict and fails pip check.
FastAPI dropped the Starlette upper bound in 0.133.0 and google-adk already moved to fastapi>=0.133,<1 / starlette>=1.3.1,<2.
Thanks for your help!
- Dominant language
- Python
- Stars
- 907
- Forks
- 467
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 40
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/python-aiplatform
-
api: vertex-ai
Difficulty 1/5 Under an hour Newbie friendliness 85/100
googleapis/python-aiplatform#7132 ·
-
api: vertex-ai
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/python-aiplatform#7097 ·
-
CustomContainerTrainingJob.run drops max_wait_duration=0 instead of requesting indefinite DWS wait Openapi: vertex-ai
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
googleapis/python-aiplatform#7067 · 1 comment ·
-
api: vertex-ai
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
googleapis/python-aiplatform#6877 ·
-
api: vertex-ai
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
googleapis/python-aiplatform#6865 · 1 comment ·
All issues in googleapis/python-aiplatform
Similar issues
-
area: harness bug status: needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Human-Agent-Society/reef#625 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 1/5 Under an hour Newbie friendliness 80/100
learningequality/kolibri#15351 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Name consistency Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
eellak/triplestore#65 · 1 comment ·