Restore FastAPI 0.137 support in the Task Execution API

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[Revanth14]

Follow-up to PR #68578.

issue #68562

Cadwyn 7.1.0 now declares fastapi>=0.137.1, so the temporary fastapi<0.137.0 cap is no longer needed.

This PR:

• Bumps cadwyn>=7.1.0.
• Relaxes FastAPI to fastapi>=0.137.1.
• Refreshes uv.lock.
• Updates execution API router assembly for FastAPI 0.137's lazy router inclusion behavior.

Bumping to FastAPI 0.137 surfaced a second incompatibility: router dependencies are frozen into each route at include_router() time. The execution API's OpenTelemetry trace-context dependency was previously injected after routers were assembled, so it was silently dropped. The router tree is now assembled through a build-time factory so the dependency is supplied up front, preserving the unsafe-always / only-authenticated / never ordering.

Tests:

• Full execution-API unit suite passes: 480 passed, 4 DB-backend skips

Related: #68578

[Revanth14]

@potiuk heads-up: removing the cap is more involved than just the dependency bump.

FastAPI 0.137's lazy router inclusion changes the router layer behavior: include_router() no longer leaves only materialized child APIRoutes in router.routes; included routers can appear as _IncludedRouter wrappers. So code/tests that iterate router.routes assuming every route has .path, .responses, etc. now break.

I fixed the execution API part in this PR by assembling the trace-context dependency at router-build time, but the bump also exposes core API route-introspection failures, for example:

FAILED core_api/routes/test_routes.py::test_no_auth_routes
AttributeError: '_IncludedRouter' object has no attribute 'path'

So this is effectively a broader FastAPI 0.137 migration that also touches security-relevant route checks. I can push it through in this PR with a small route-materialization helper, or split it into a dedicated migration PR. Do you have a preference? And is the 0.137 migration already tracked anywhere?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[potiuk]

Opened a scope/decision issue for the broader FastAPI 0.137 migration this PR surfaces: #69065 — let's settle the direction (and target 3.4.0) with the FastAPI/token-scope/security owners there before driving this to merge. Thanks for the clear heads-up, @Revanth14.

---

Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting

[potiuk]

@Revanth14 This draft PR has had no activity for 2 weeks. Closing to keep the queue clean.

You are welcome to reopen and continue when you're ready. If you'd like to pick it back up, please rebase onto the current main branch first.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. If you have questions, an Apache Airflow maintainer — a real person — is happy to help. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.