
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
This package provides hot module reloading (HMR) for uvicorn
.
It uses watchfiles
to detect FS modifications,
re-executes the corresponding modules with hmr
and restart the server (in the same process).
HOT means the main process never restarts, and reloads are fine-grained (only the changed modules and their dependent modules are reloaded).
Since the reload is on-demand and the server is not restarted on every save, it is much faster than the built-in --reload
option provided by uvicorn
.
uvicorn --reload
, it restarts the whole process on every file change, but restarting the whole process is unnecessary:
hmr
tracks dependencies at runtime, remembers the relationships between your modules and only reruns necessary modules.__getattr__
still worksimportlib.import_module
or even __import__
still work__init__.py
and sibling modules still workgetsource
calls work too__name__
, __doc__
, __file__
, __package__
are correctly setNormally, you can replace uvicorn --reload
with uvicorn-hmr
and everything will work as expected, with a much faster reload experience.
pip install uvicorn-hmr
pip install uvicorn-hmr[all]
This will install fastapi-reloader
too, which enables you to use --reload
flag to reload the browser pages when the server restarts.
When you enable the
--reload
flag, it means you want to use thefastapi-reloader
package to enable automatic HTML page reloading. This behavior differs from Uvicorn's built-in--reload
functionality. (See the configuration section for more details.)Server reloading is a core feature of
uvicorn-hmr
and is always active, regardless of whether the--reload
flag is set. The--reload
flag specifically controls auto-reloading of HTML pages, a feature not available in Uvicorn.If you don't need HTML page auto-reloading, simply omit the
--reload
flag. If you do want this feature, ensure thatfastapi-reloader
is installed by running:pip install fastapi-reloader
orpip install uvicorn-hmr[all]
.
Replace
uvicorn main:app --reload
with
uvicorn-hmr main:app
Everything will work as-expected, but with hot module reloading.
I haven't copied all the configurable options from uvicorn
. But contributions are welcome!
For now, host
, port
, log-level
, env-file
are supported and have exactly the same semantics and types as in uvicorn
.
The behavior of reload_include
and reload_exclude
is different from uvicorn in several ways:
*.py
), but in uvicorn-hmr only file or directory paths are allowed; patterns will be treated as literal paths.reload-include
or reload-exclude
, all Python files are still watched/excluded accordingly), but uvicorn-hmr only includes/excludes the paths you specify. If you do not provide reload_include
, the current directory is included by default; if you do provide it, only the specified paths are included. The same applies to reload_exclude
.The following options are supported but do not have any alternative in uvicorn
:
--reload
: Enables auto-refreshing of HTML pages in the browser whenever the server restarts. Useful for demo purposes and visual debugging. This is totally different from uvicorn
's built-in --reload
option, which is always enabled and can't be disabled in uvicorn-hmr
because hot-reloading is the core feature of this package.--clear
: Wipes the terminal before each reload. Just like vite
does by default.The two features above are opinionated and are disabled by default. They are just my personal practices. If you find them useful or want to suggest some other features, feel free to open an issue.
FAQs
Hot Module Reloading for Uvicorn
We found that uvicorn-hmr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.