fix(deps): cap fastapi <0.137.0 to stop OPTIONS preflight 500s

FastAPI 0.137.0 made app.routes a tree containing _IncludedRouter
wrapper objects that do not expose a .path attribute, instead of a flat
list of routes that each have .path. The OTel FastAPI auto-instrumentation
(injected at runtime by the observability operator, so not a dependency we
can bump here) reads route.path on a Match.PARTIAL while building the
request span. A browser CORS preflight (OPTIONS) has no declared endpoint,
so it only PARTIAL-matches the _IncludedRouter, raising AttributeError in
the ASGI layer (outside FastAPI's exception handlers) and returning HTTP
500. This blocks the Agents UI from loading.

The version actually resolved by the workspace is controlled by the root
pyproject's override-dependencies, which floored fastapi>=0.135.0 with no
ceiling and so picked up 0.137+. Cap it (and the agentex package dep) at
<0.137.0. Pinning up does not help: 0.137.1/0.137.2/0.138.0 keep
_IncludedRouter and only add a new iter_route_contexts() helper the pinned
injected instrumentation does not use. The starlette>=1.3.1 override keeps
the existing CVE fixes regardless of the cap; resolution lands on 0.136.3.

Add a regression test asserting every app.routes entry exposes .path and
that OPTIONS-preflight route matching cannot crash, so a future fastapi
bump that reintroduces the regression fails CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: declan-scale

agentex/pyproject.toml

@@ -6,7 +6,7 @@ authors = [{ name = "Felix Su", email = "felix.su@scale.com" }]
 requires-python = ">=3.12,<3.13"
 readme = "README.md"
 dependencies = [
-    "fastapi>=0.115.0",
+    "fastapi>=0.115.0,<0.137.0",  # <0.137.0 keeps app.routes flat; 0.137.0's _IncludedRouter (no .path) crashes injected OTel instrumentation on OPTIONS preflights -> 500
     "litellm>=1.84.0,<2",  # >=1.84.0 clears CVE-2026-49468 (CRITICAL auth bypass)
     "python-dotenv>=1.2.2,<2",
     "temporalio>=1.18.0,<2",

agentex/tests/unit/api/test_otel_route_compat.py

@@ -0,0 +1,55 @@
+"""
+Regression test for the OPTIONS/CORS preflight 500 caused by FastAPI's
+``_IncludedRouter`` change.
+
+FastAPI 0.137.0 made ``app.routes`` a tree that can contain ``_IncludedRouter``
+wrapper objects (one per ``include_router()`` call). Those wrappers do NOT
+expose a ``.path`` attribute. The OpenTelemetry FastAPI auto-instrumentation
+(injected at runtime by the observability operator, so it is not a dependency we
+can bump here) reads ``route.path`` on a ``Match.PARTIAL`` while building the
+request span. A browser CORS preflight (``OPTIONS``) has no declared endpoint,
+so it only PARTIAL-matches the ``_IncludedRouter`` -> ``AttributeError`` raised
+inside the ASGI layer (outside FastAPI's exception handlers) -> HTTP 500.
+
+The only lever we control is the FastAPI version we ship, so we pin
+``fastapi < 0.137.0`` to keep ``app.routes`` a flat list of routes that all
+expose ``.path``. Pinning *up* does not help: 0.137.1/0.137.2/0.138.0 keep the
+``_IncludedRouter`` and only add a new ``iter_route_contexts()`` helper that the
+pinned injected instrumentation does not use.
+
+If this test fails, FastAPI has been bumped to a version that reintroduces the
+preflight-crash regression for the injected OTel instrumentation.
+"""
+
+import pytest
+from src.api.app import fastapi_app
+from starlette.routing import Match
+
+
+@pytest.mark.unit
+class TestOtelRouteCompat:
+    def test_every_route_exposes_path(self):
+        """Every entry in app.routes must expose ``.path`` (what OTel reads)."""
+        missing = [
+            type(route).__name__
+            for route in fastapi_app.routes
+            if not hasattr(route, "path")
+        ]
+        assert not missing, (
+            "Routes without a `.path` attribute would crash the injected OTel "
+            f"FastAPI instrumentation on OPTIONS preflights: {missing}. "
+            "This usually means FastAPI was bumped to >= 0.137.0."
+        )
+
+    def test_options_preflight_route_matching_does_not_crash(self):
+        """Simulate OTel `_get_route_details` over an OPTIONS preflight scope."""
+        scope = {
+            "type": "http",
+            "method": "OPTIONS",
+            "path": "/agents",
+            "headers": [],
+        }
+        for route in fastapi_app.routes:
+            match, _ = route.matches(scope)
+            if match in (Match.FULL, Match.PARTIAL):
+                assert route.path is not None

pyproject.toml

@@ -27,8 +27,12 @@ environments = [
 # carries the fixes for CVE-2026-48818 / CVE-2026-54283 (and CVE-2025-62727).
 # python-multipart>=0.0.32 clears CVE-2026-53539. Keep these floors at the patched
 # minimums so a re-resolve can't regress below them.
+# fastapi is capped <0.137.0: 0.137.0 made app.routes a tree of _IncludedRouter
+# wrappers (no .path), which crashes the injected OTel FastAPI instrumentation on
+# OPTIONS/CORS preflights (-> 500). 0.137.1/0.137.2/0.138.0 do not restore the flat
+# list. The starlette>=1.3.1 floor below keeps the CVE fixes regardless of this cap.
 override-dependencies = [
-    "fastapi>=0.135.0",
+    "fastapi>=0.135.0,<0.137.0",
     "starlette>=1.3.1",
     "httpx[http2]>=0.28.1,<0.29",
     "langchain-core>=1.3.3",