[joakimnordling]

Updates the bundled Swagger UI to 5.34.1 (from 5.33.1) and bumps the version for a 0.3.1 release.

The eMudhra/emSign CA certificate incident doesn't affect users of the library: it makes no TLS connections when serving the docs, and none of its runtime dependencies ships a CA bundle. The development and release tooling here was affected, so it's updated too, together with FastAPI in the lock and the dev tools.

The commits are self-contained.

Commits

1. Fix security issues in the tooling. The emSign root CA has been removed from CA bundles after a compromise of eMudhra intermediate certificates, so everything here that ships its own CA bundle or relies on one is updated:

   • require uv >= 0.13.6 and uv_build >= 0.13.5. uv 0.13.4 removes the emSign root from its certificate store (GHSA-hq85-5cpj-mr62), and 0.13.5 also rejects certificate chains containing the compromised intermediate keys. uv 0.13.6 adds CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2, so CI tests on the latest patch releases, which include security fixes. uv_build stays at >= 0.13.5: the build backend doesn't choose the Python, and 0.13.6 has no backend fixes
   • the uv-pre-commit hook 0.13.6
   • astral-sh/setup-uv v10.3.3, which knows the checksums of uv 0.13.6
   • UV_PYTHON_PREFERENCE: only-managed in both workflows, so uv uses its own Python builds with the latest patch releases instead of the runner's system Python (3.12.3 on Ubuntu 24.04 for the 3.12 job)
   • pypa/gh-action-pypi-publish v1.14.3 (GHSA-5xjx-3w67-w9x9)
   • virtualenv 21.14.13 in the lock, which bundles pip 26.2.2 for the pre-commit hook environments

   The virtualenv update also fixes the 12 advisories against the previously locked 21.14.6, and filelock 4.2.4 fixes the 6 advisories against 4.1.0 published on 2026-10-23. Both only come in through pre-commit, so they only affect the development tooling.

2. Test with a server-provided root_path. FastAPI 0.146.0 deprecates the root_path parameter of FastAPI() in favour of configuring the server, e.g. fastapi run --root-path /api/v1. test_root_path used the parameter, so it now gets its root_path from the server (TestClient(app, root_path="/api/v1")). The parameter only ever set that same scope value, so the library code path is the same. The test now also checks that the static files load from under /api/v1/....

3. Update Swagger UI to 5.34.1 (from 5.33.1). 5.33.2 and 5.33.3 contain bug fixes and dependency bumps (DOMPurify, swagger-client), 5.34.0 adds filtering operations by path and OpenAPI 3.2 additionalOperations, and 5.34.1 fixes handling of non-Map values in responses. The bundle and the CSS changed; the LICENSE is identical. The downloaded files match the npm package, whose tarball matches npm's sha512 integrity.

4. Update FastAPI, the dev tools and the locked dependencies. FastAPI 0.162.0 and Starlette 1.10.0 in the lock, ruff 0.17.3 (pin and ruff-pre-commit rev), httpx2 2.16.0, pre-commit 4.7.0, pytest 9.2.0, mypy 2.4.1, and a refresh of the rest of the lock.

5. Audit the lock without resolving it. uv audit --frozen audits uv.lock as it is. Without --frozen, uv resolved the project first and looked for the Python in .python-version (3.11), so the 3.12 to 3.15 jobs downloaded CPython 3.11, about 29 MiB, just for the audit. The audit covers the same 39 packages with the same result. The lock is still checked, by the uv-lock pre-commit hook and by uv sync --locked.

6. Bump the version to 0.3.1.

No library code changes; the fastapi>=0.133.0,<1 range stays as it is.

FastAPI releases reviewed

Between the previously locked 0.143.0 and 0.162.0, two releases touch what we use:

• 0.145.0 removes the deprecated openapi_prefix parameter and **extra. We use neither.
• 0.146.0 deprecates the root_path parameter (commit 2).

The other releases change request parameter, form and body handling, among other things. fastapi/openapi/docs.py and fastapi/staticfiles.py are unchanged, and the docs routes still call get_swagger_ui_html / get_redoc_html from fastapi.applications with an openapi_url built from the request's root_path, so the patching keeps working unchanged.

Left out on purpose

• ReDoc 3 stays out; we keep ReDoc 2.5.4, which is also what FastAPI itself points to (redoc@2).
• Prettier: the mirrors-prettier hook (v2.7.1) is archived. Moving to Prettier 3 needs a different hook setup and may reformat the Markdown/YAML, so it's for a separate PR.

Testing

uv run invoke test (pre-commit, mypy, 15 tests with no warnings, uv audit) passes on each of the six commits, each with its own lock file.

CI only tests the locked FastAPI version, so I also checked the docs HTML and static files with a server-provided root_path by hand on FastAPI 0.133.0 + Starlette 0.40.0, 0.133.0 + 1.7.0, 0.138.0 + 0.46.0, 0.143.0 + 1.7.0, 0.146.0 + 1.7.0 and 0.162.0 + 1.10.0. All passed. The changes were also checked locally.

🤖 Generated with Claude Code