diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
deleted file mode 100644
index 0ffc101a3f..0000000000
--- a/.github/FUNDING.yml
+++ /dev/null
@@ -1 +0,0 @@
-github: [tiangolo]
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 918a98f511..95c9f07cb9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,26 +4,47 @@ updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
cooldown:
default-days: 7
commit-message:
prefix: ⬆
+ labels:
+ - "internal"
+ - "dependencies"
+ - "github_actions"
+ groups:
+ github-actions:
+ patterns:
+ - "*"
# Python
- package-ecosystem: "uv"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
cooldown:
default-days: 7
commit-message:
prefix: ⬆
+ groups:
+ python-packages:
+ dependency-type: "development"
+ patterns:
+ - "*"
# pre-commit
- package-ecosystem: "pre-commit"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
cooldown:
default-days: 7
commit-message:
prefix: ⬆
+ labels:
+ - "internal"
+ - "dependencies"
+ - "pre-commit"
+ groups:
+ pre-commit:
+ patterns:
+ - "*"
diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 01a0824449..35d089860c 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -13,8 +13,9 @@ jobs:
add-to-project:
name: Add to project
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
+ - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
with:
project-url: https://github.com/orgs/fastapi/projects/2
github-token: ${{ secrets.PROJECTS_TOKEN }} # zizmor: ignore[secrets-outside-env]
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index d8e5d9e943..128b69e94d 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -16,6 +16,7 @@ jobs:
# Required permissions
permissions:
pull-requests: read
+ timeout-minutes: 5
# Set job outputs to values from filter step
outputs:
docs: ${{ steps.filter.outputs.docs }}
@@ -34,15 +35,15 @@ jobs:
- docs_src/**
- pyproject.toml
- uv.lock
- - mkdocs.yml
- - mkdocs.env.yml
- .github/workflows/build-docs.yml
- .github/workflows/deploy-docs.yml
- - scripts/mkdocs_hooks.py
+ - scripts/docs.py
langs:
needs:
- changes
+ if: ${{ needs.changes.outputs.docs == 'true' }}
runs-on: ubuntu-latest
+ timeout-minutes: 5
outputs:
langs: ${{ steps.show-langs.outputs.langs }}
steps:
@@ -56,6 +57,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
@@ -74,6 +77,7 @@ jobs:
- langs
if: ${{ needs.changes.outputs.docs == 'true' }}
runs-on: ubuntu-latest
+ timeout-minutes: 7
strategy:
matrix:
lang: ${{ fromJson(needs.langs.outputs.langs) }}
@@ -92,6 +96,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
@@ -103,21 +109,28 @@ jobs:
run: uv run ./scripts/docs.py update-languages
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
- key: mkdocs-cards-${{ matrix.lang }}-${{ github.ref }}
- path: docs/${{ matrix.lang }}/.cache
+ key: zensical-${{ matrix.lang }}-${{ github.ref }}
+ path: site_zensical_src/${{ matrix.lang }}/.cache
- name: Build Docs
run: | # zizmor: ignore[template-injection] - comes from trusted source
uv run ./scripts/docs.py build-lang ${{ matrix.lang }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: docs-site-${{ matrix.lang }}
- path: ./site/**
+ # English owns root static assets. Translated pages reference /img, /css,
+ # and /js, so omit duplicated language-local copies from artifacts.
+ path: |
+ ./site/**
+ !./site/${{ matrix.lang }}/img/**
+ !./site/${{ matrix.lang }}/css/**
+ !./site/${{ matrix.lang }}/js/**
include-hidden-files: true
# https://github.com/marketplace/actions/alls-green#why
docs-all-green: # This job does nothing and is only used for the branch protection
if: always()
needs:
+ - langs
- build-docs
runs-on: ubuntu-latest
steps:
@@ -125,4 +138,4 @@ jobs:
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}
- allowed-skips: build-docs
+ allowed-skips: langs, build-docs
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 17649a653d..cc963ee55b 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -33,6 +33,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 503aec2a85..1009ec6aaf 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -16,6 +16,7 @@ jobs:
issues: write
pull-requests: write
statuses: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -31,6 +32,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: false
- name: Install GitHub Actions dependencies
@@ -60,7 +63,7 @@ jobs:
env:
PROJECT_NAME: fastapitiangolo
BRANCH: ${{ ( github.event.workflow_run.head_repository.full_name == github.repository && github.event.workflow_run.head_branch == 'master' && 'main' ) || ( github.event.workflow_run.head_sha ) }}
- uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3.15.0
+ uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} # zizmor: ignore[secrets-outside-env]
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} # zizmor: ignore[secrets-outside-env]
diff --git a/.github/workflows/detect-conflicts.yml b/.github/workflows/detect-conflicts.yml
index 38d526bd9b..b824f8ae3a 100644
--- a/.github/workflows/detect-conflicts.yml
+++ b/.github/workflows/detect-conflicts.yml
@@ -12,6 +12,7 @@ jobs:
contents: read
pull-requests: write
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Check if PRs have merge conflicts
uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
diff --git a/.github/workflows/guard-dependencies.yml b/.github/workflows/guard-dependencies.yml
new file mode 100644
index 0000000000..142c7e50ed
--- /dev/null
+++ b/.github/workflows/guard-dependencies.yml
@@ -0,0 +1,53 @@
+name: Guard Dependencies
+
+on:
+ pull_request_target: # zizmor: ignore[dangerous-triggers] -- This workflow only reads context.payload metadata, never checks out PR code
+ branches: [master]
+ paths:
+ - pyproject.toml
+ - uv.lock
+
+permissions:
+ contents: read
+ issues: write
+ pull-requests: write
+
+jobs:
+ check-author:
+ runs-on: ubuntu-latest
+ timeout-minutes: 5
+ steps:
+ - name: Check if author is org member or allowed bot
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+ with:
+ script: |
+ const pr = context.payload.pull_request;
+ const author = pr.user.login;
+ const assoc = pr.author_association;
+
+ const botAllowlist = new Set(['dependabot[bot]']);
+ const orgAuthorAssociations = new Set(['MEMBER', 'OWNER']);
+
+ const allowed =
+ botAllowlist.has(author) ||
+ (assoc != null && orgAuthorAssociations.has(assoc));
+
+ if (!allowed) {
+ await github.rest.issues.createComment({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: context.payload.pull_request.number,
+ body: `This PR modifies dependency files (\`pyproject.toml\` or \`uv.lock\`), which is restricted to members of the **${context.repo.owner}** organization on GitHub.\n\nIf you need a dependency change, please [open a discussion](https://github.com/${context.repo.owner}/${context.repo.repo}/discussions/new) describing what you need and why.\n\nClosing this PR automatically.`
+ });
+
+ await github.rest.pulls.update({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: context.payload.pull_request.number,
+ state: 'closed'
+ });
+
+ core.setFailed('Dependency changes are restricted to organization members.');
+ } else {
+ console.log(`Author ${author} (author_association=${assoc}) is allowed to make dependency changes.`);
+ }
diff --git a/.github/workflows/issue-manager.yml b/.github/workflows/issue-manager.yml
index c0ffd7ac70..fca3f1f2f8 100644
--- a/.github/workflows/issue-manager.yml
+++ b/.github/workflows/issue-manager.yml
@@ -23,6 +23,7 @@ jobs:
permissions:
issues: write
pull-requests: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
diff --git a/.github/workflows/label-approved.yml b/.github/workflows/label-approved.yml
index e8ad87439c..55ec5c1c14 100644
--- a/.github/workflows/label-approved.yml
+++ b/.github/workflows/label-approved.yml
@@ -13,6 +13,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
pull-requests: write
+ timeout-minutes: 7
steps:
- name: Dump GitHub context
env:
@@ -28,6 +29,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 58c6892375..5b7524f25e 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -17,8 +17,9 @@ jobs:
contents: read
pull-requests: write
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+ - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
if: ${{ github.event.action != 'labeled' && github.event.action != 'unlabeled' }}
- run: echo "Done adding labels"
# Run this after labeler applied labels
@@ -28,6 +29,7 @@ jobs:
permissions:
pull-requests: read
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
with:
diff --git a/.github/workflows/latest-changes.yml b/.github/workflows/latest-changes.yml
index aaa12c17d5..12bc676865 100644
--- a/.github/workflows/latest-changes.yml
+++ b/.github/workflows/latest-changes.yml
@@ -22,6 +22,7 @@ jobs:
latest-changes:
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
diff --git a/.github/workflows/notify-translations.yml b/.github/workflows/notify-translations.yml
index 9b8c6d7f1e..820ac70406 100644
--- a/.github/workflows/notify-translations.yml
+++ b/.github/workflows/notify-translations.yml
@@ -24,6 +24,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
discussions: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -39,6 +40,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/people.yml b/.github/workflows/people.yml
index d3baec1d06..b9c0502a52 100644
--- a/.github/workflows/people.yml
+++ b/.github/workflows/people.yml
@@ -33,6 +33,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 5e358e8f27..1e156b2499 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -15,6 +15,7 @@ env:
jobs:
pre-commit:
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -48,6 +49,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
cache-dependency-glob: |
pyproject.toml
@@ -84,6 +87,7 @@ jobs:
needs:
- pre-commit
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 32d6ea4f98..307b3cb3c0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,6 +13,7 @@ jobs:
permissions:
id-token: write
contents: read
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -28,7 +29,10 @@ jobs:
- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
+ enable-cache: "false"
- name: Build distribution
run: uv build
- name: Publish
diff --git a/.github/workflows/smokeshow.yml b/.github/workflows/smokeshow.yml
index c177b7390b..27bb8b195c 100644
--- a/.github/workflows/smokeshow.yml
+++ b/.github/workflows/smokeshow.yml
@@ -12,6 +12,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
statuses: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
@@ -27,6 +28,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
cache-dependency-glob: |
pyproject.toml
diff --git a/.github/workflows/sponsors.yml b/.github/workflows/sponsors.yml
index b1ab7f11d8..f1538caef1 100644
--- a/.github/workflows/sponsors.yml
+++ b/.github/workflows/sponsors.yml
@@ -18,6 +18,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -33,6 +34,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/test-redistribute.yml b/.github/workflows/test-redistribute.yml
index fad16fb2cd..c78fbff565 100644
--- a/.github/workflows/test-redistribute.yml
+++ b/.github/workflows/test-redistribute.yml
@@ -14,6 +14,7 @@ permissions: {}
jobs:
test-redistribute:
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -57,6 +58,7 @@ jobs:
needs:
- test-redistribute
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Decide whether the needed jobs succeeded or failed
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 05cb1a02ee..df77c9bde0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -25,6 +25,7 @@ jobs:
permissions:
pull-requests: read
# Set job outputs to values from filter step
+ timeout-minutes: 5
outputs:
src: ${{ steps.filter.outputs.src }}
steps:
@@ -50,6 +51,7 @@ jobs:
needs:
- changes
if: needs.changes.outputs.src == 'true' || github.ref == 'refs/heads/master'
+ timeout-minutes: 10
strategy:
matrix:
os: [ windows-latest, macos-latest ]
@@ -81,6 +83,11 @@ jobs:
uv-resolution: highest
codspeed: codspeed
deprecated-tests: "no-deprecation"
+ - os: ubuntu-latest
+ python-version: "3.13"
+ uv-resolution: highest
+ deprecated-tests: "no-deprecation"
+ without-httpx2: true
- os: ubuntu-latest
python-version: "3.14"
coverage: coverage
@@ -113,6 +120,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
@@ -129,15 +138,19 @@ jobs:
- name: Install deprecated libraries just for testing
if: matrix.deprecated-tests == 'test-deprecation'
run: uv pip install orjson ujson
+ - name: Uninstall httpx2 to run tests with httpx
+ if: matrix.without-httpx2 == 'true'
+ run: uv pip uninstall httpx2
- name: Reinstall SQLAlchemy without Cython extensions
if: matrix.python-version == '3.14t' && matrix.os == 'ubuntu-latest'
run: "DISABLE_SQLALCHEMY_CEXT=1 uv pip install --force-reinstall --no-binary :all: sqlalchemy"
- run: mkdir coverage
- name: Test
- run: uv run --no-sync bash scripts/test-cov.sh
+ run: uv run --no-sync bash scripts/test-cov.sh $PYTEST_OPTIONS
env:
COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}-${{ matrix.deprecated-tests}}
CONTEXT: ${{ runner.os }}-py${{ matrix.python-version }}-${{ matrix.deprecated-tests}}
+ PYTEST_OPTIONS: ${{ (matrix.without-httpx2 == 'true') && '-W ignore::UserWarning' || '' }}
# Do not store coverage for all possible combinations to avoid file size max errors in Smokeshow
- name: Store coverage files
if: matrix.coverage == 'coverage'
@@ -152,6 +165,7 @@ jobs:
- changes
if: needs.changes.outputs.src == 'true' || github.ref == 'refs/heads/master'
runs-on: ubuntu-latest
+ timeout-minutes: 5
env:
UV_PYTHON: "3.13"
UV_RESOLUTION: highest
@@ -170,6 +184,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
@@ -187,6 +203,7 @@ jobs:
needs:
- test
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -201,6 +218,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
@@ -232,6 +251,7 @@ jobs:
- coverage-combine
- benchmark
runs-on: ubuntu-latest
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
diff --git a/.github/workflows/topic-repos.yml b/.github/workflows/topic-repos.yml
index 69bfdaff9d..1b34f1f58f 100644
--- a/.github/workflows/topic-repos.yml
+++ b/.github/workflows/topic-repos.yml
@@ -13,6 +13,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: write
+ timeout-minutes: 5
steps:
- name: Dump GitHub context
env:
@@ -28,6 +29,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
enable-cache: true
cache-dependency-glob: |
diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml
index 87023623ed..4c624c93c8 100644
--- a/.github/workflows/translate.yml
+++ b/.github/workflows/translate.yml
@@ -60,6 +60,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
cache-dependency-glob: |
pyproject.toml
@@ -101,6 +103,8 @@ jobs:
- name: Setup uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
+ # Before upgrading uv version, make sure astral-sh/setup-uv knows its checksum.
+ # See: https://github.com/astral-sh/setup-uv/issues/851#issuecomment-4282017837
version: "0.11.4"
cache-dependency-glob: |
pyproject.toml
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000000..1ce7c7bcef
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,24 @@
+name: Zizmor
+
+on:
+ push:
+ branches:
+ - main
+ workflow_dispatch:
+
+permissions: {}
+
+jobs:
+ zizmor:
+ name: Run zizmor
+ runs-on: ubuntu-latest
+ timeout-minutes: 5
+ permissions:
+ security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - name: Run zizmor
+ uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
diff --git a/.gitignore b/.gitignore
index 243cdb93a5..2c0d859ad7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ __pycache__
htmlcov
dist
site
+site_zensical_src
.coverage*
coverage.xml
.netlify
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d304b78e8c..b53e2c9ea8 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -96,6 +96,6 @@ repos:
name: zizmor
language: python
entry: uv run zizmor .
- files: ^\.github\/workflows\/
+ files: ^\.github/workflows/|^uv\.lock$
require_serial: true
pass_filenames: false
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
deleted file mode 100644
index 7b94527252..0000000000
--- a/CONTRIBUTING.md
+++ /dev/null
@@ -1 +0,0 @@
-Please read the [Development - Contributing](https://fastapi.tiangolo.com/contributing/) guidelines in the documentation site.
diff --git a/README.md b/README.md
index 97f7944754..eb0368762b 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,7 @@ The key features are:
+
diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index 87e87e0ca1..0000000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Security Policy
-
-Security is very important for FastAPI and its community. 🔒
-
-Learn more about it below. 👇
-
-## Versions
-
-The latest version of FastAPI is supported.
-
-You are encouraged to [write tests](https://fastapi.tiangolo.com/tutorial/testing/) for your application and update your FastAPI version frequently after ensuring that your tests are passing. This way you will benefit from the latest features, bug fixes, and **security fixes**.
-
-You can learn more about [FastAPI versions and how to pin and upgrade them](https://fastapi.tiangolo.com/deployment/versions/) for your project in the docs.
-
-## Reporting a Vulnerability
-
-If you think you found a vulnerability, and even if you are not sure about it, please report it right away by sending an email to: security@tiangolo.com. Please try to be as explicit as possible, describing all the steps and example code to reproduce the security issue.
-
-I (the author, [@tiangolo](https://x.com/tiangolo)) will review it thoroughly and get back to you.
-
-## Public Discussions
-
-Please restrain from publicly discussing a potential security vulnerability. 🙊
-
-It's better to discuss privately and try to find a solution first, to limit the potential impact as much as possible.
-
----
-
-Thanks for your help!
-
-The FastAPI community and I thank you for that. 🙇
diff --git a/docs/de/docs/advanced/generate-clients.md b/docs/de/docs/advanced/generate-clients.md
index 12ba4072c4..4eab5bcb6f 100644
--- a/docs/de/docs/advanced/generate-clients.md
+++ b/docs/de/docs/advanced/generate-clients.md
@@ -30,7 +30,6 @@ Ihr Sponsoring zeigt auch ein starkes Engagement für die FastAPI-**Community**
Zum Beispiel könnten Sie ausprobieren:
-* [Speakeasy](https://speakeasy.com/editor?utm_source=fastapi+repo&utm_medium=github+sponsorship)
* [Stainless](https://www.stainless.com/?utm_source=fastapi&utm_medium=referral)
* [liblab](https://developers.liblab.com/tutorials/sdk-for-fastapi?utm_source=fastapi)
diff --git a/docs/de/docs/index.md b/docs/de/docs/index.md
index d2c2829591..d557554a12 100644
--- a/docs/de/docs/index.md
+++ b/docs/de/docs/index.md
@@ -1,3 +1,8 @@
+---
+include_yaml:
+ sponsors: data/sponsors.yml
+---
+
# FastAPI { #fastapi }