Fix after recent behavioral change in FastAPI/Starlette. The HTTPBearer security scheme now returns 401 instead of 403 when no credentials are provided.

Author: gotsysdba

.github/workflows/pytest.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip wheel setuptools uv
-          uv pip install torch==2.9.0+cpu -f https://download.pytorch.org/whl/cpu/torch --system
+          uv pip install torch==2.9.1+cpu -f https://download.pytorch.org/whl/cpu/torch --system
           uv pip install -e ".[all-test]" --system
           curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
 

opentofu/modules/vm/templates/cloudinit-compute.tpl

@@ -69,7 +69,7 @@ write_files:
       python3.11 -m venv .venv
       source .venv/bin/activate
       pip3.11 install --upgrade pip wheel setuptools uv
-      uv pip install torch==2.9.0+cpu -f https://download.pytorch.org/whl/cpu/torch
+      uv pip install torch==2.9.1+cpu -f https://download.pytorch.org/whl/cpu/torch
       uv pip install -e ".[all]" &
       INSTALL_PID=$!
 

pyproject.toml

@@ -17,7 +17,7 @@ dependencies = [
     "langchain-core==0.3.80",
     "httpx==0.28.1",
     "oracledb~=3.1",
-    "plotly==6.3.1",
+    "plotly==6.5.0",
 ]
 
 [project.optional-dependencies]
@@ -26,7 +26,7 @@ server = [
     "bokeh==3.8.1",
     "evaluate==0.4.6",
     "faiss-cpu==1.13.0",
-    "fastapi==0.121.3",
+    "fastapi==0.122.0",
     "fastmcp==2.13.1",
     "giskard==2.18.0",
     "langchain-aimlapi==0.1.0",
@@ -50,7 +50,7 @@ server = [
     "oci~=2.0",
     "psutil==7.1.3",
     "python-multipart==0.0.20",
-    "torch==2.9.0",
+    "torch==2.9.1",
     "umap-learn==0.5.9.post2",
     "uvicorn==0.38.0",
 ]

src/Dockerfile

@@ -21,7 +21,7 @@ COPY --chown=$RUNUSER:$RUNUSER src /opt/package/src
 COPY pyproject.toml /opt/package/pyproject.toml
 
 RUN ${VIRTUAL_ENV}/bin/pip install --upgrade pip wheel setuptools uv && \
-    ${VIRTUAL_ENV}/bin/uv pip install torch==2.9.0+cpu -f https://download.pytorch.org/whl/cpu/torch && \
+    ${VIRTUAL_ENV}/bin/uv pip install torch==2.9.1+cpu -f https://download.pytorch.org/whl/cpu/torch && \
     ${VIRTUAL_ENV}/bin/uv pip install "/opt/package[all]"
 
 ##################################################

src/server/Dockerfile

@@ -23,7 +23,7 @@ COPY --chown=$RUNUSER:$RUNUSER src /opt/package/src
 COPY pyproject.toml /opt/package/pyproject.toml
 
 RUN ${VIRTUAL_ENV}/bin/pip install --upgrade pip wheel setuptools uv && \
-    ${VIRTUAL_ENV}/bin/uv pip install torch==2.9.0+cpu -f https://download.pytorch.org/whl/cpu/torch && \
+    ${VIRTUAL_ENV}/bin/uv pip install torch==2.9.1+cpu -f https://download.pytorch.org/whl/cpu/torch && \
     ${VIRTUAL_ENV}/bin/uv pip install "/opt/package[server]"
 
 ##################################################

tests/server/integration/test_endpoints_chat.py

@@ -22,7 +22,7 @@ class TestEndpoints:
     @pytest.mark.parametrize(
         "auth_type, status_code",
         [
-            pytest.param("no_auth", 403, id="no_auth"),
+            pytest.param("no_auth", 401, id="no_auth"),
             pytest.param("invalid_auth", 401, id="invalid_auth"),
         ],
     )

tests/server/integration/test_endpoints_databases.py

@@ -18,7 +18,7 @@ class TestEndpoints:
     @pytest.mark.parametrize(
         "auth_type, status_code",
         [
-            pytest.param("no_auth", 403, id="no_auth"),
+            pytest.param("no_auth", 401, id="no_auth"),
             pytest.param("invalid_auth", 401, id="invalid_auth"),
         ],
     )

tests/server/integration/test_endpoints_embed.py

@@ -46,7 +46,7 @@ class TestEndpoints:
     @pytest.mark.parametrize(
         "auth_type, status_code",
         [
-            pytest.param("no_auth", 403, id="no_auth"),
+            pytest.param("no_auth", 401, id="no_auth"),
             pytest.param("invalid_auth", 401, id="invalid_auth"),
         ],
     )

tests/server/integration/test_endpoints_models.py

@@ -17,7 +17,7 @@ class TestEndpoints:
     @pytest.mark.parametrize(
         "auth_type, status_code",
         [
-            pytest.param("no_auth", 403, id="no_auth"),
+            pytest.param("no_auth", 401, id="no_auth"),
             pytest.param("invalid_auth", 401, id="invalid_auth"),
         ],
     )

tests/server/integration/test_endpoints_oci.py

@@ -95,7 +95,7 @@ class TestEndpoints:
     @pytest.mark.parametrize(
         "auth_type, status_code",
         [
-            pytest.param("no_auth", 403, id="no_auth"),
+            pytest.param("no_auth", 401, id="no_auth"),
             pytest.param("invalid_auth", 401, id="invalid_auth"),
         ],
     )