Skip to content

feat(sample-app): add FastAPI + LiteLLM tracing example #4227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pm32900 wants to merge 3 commits into
base: main
Choose a base branch
from
+123 −39
Open

feat(sample-app): add FastAPI + LiteLLM tracing example #4227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ed05986
feat(sample-app): add FastAPI + LiteLLM tracing example
pm32900 Jun 10, 2026
2003cfb
fix(sample-app): add ConsoleSpanExporter, error handling, and respons…
pm32900 Jun 16, 2026
8e2c035
Merge branch 'main' into feat/fastapi-litellm-example
pm32900 Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions packages/sample-app/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ dependencies = [
"llama-index-llms-huggingface>=0.6.0,<0.7.0",
"llama-index-llms-huggingface-api>=0.6.0,<0.7.0",
"litellm>=1.51.0,<2",
"fastapi>=0.115.0,<1",
"uvicorn>=0.32.0,<1",
Comment on lines +40 to +41

@coderabbitai coderabbitai Bot Jun 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify FastAPI and Uvicorn versions and check for security advisories

echo "=== Checking FastAPI latest version ==="
curl -s https://pypi.org/pypi/fastapi/json | jq -r '.info.version'

echo -e "\n=== Checking Uvicorn latest version ==="
curl -s https://pypi.org/pypi/uvicorn/json | jq -r '.info.version'

echo -e "\n=== Checking for FastAPI security advisories ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: PIP, package: "fastapi") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

echo -e "\n=== Checking for Uvicorn security advisories ==="
gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: PIP, package: "uvicorn") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Repository: traceloop/openllmetry

Length of output: 1175

Bump FastAPI minimum version (current range includes HIGH-severity CSRF advisory)

In packages/sample-app/pyproject.toml (lines 40-41), fastapi>=0.115.0,<1 includes versions <0.65.2, which are affected by a HIGH CSRF advisory (patched in 0.65.2). Set the lower bound to >=0.65.2 (or otherwise exclude <0.65.2).
The listed Uvicorn HIGH advisories affect <0.11.7, so uvicorn>=0.32.0,<1 is not impacted by those.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/sample-app/pyproject.toml` around lines 40 - 41, Update the FastAPI
dependency constraint in packages/sample-app pyproject.toml to exclude
vulnerable releases: replace the current fastapi spec (the string
"fastapi>=0.115.0,<1") with a range that sets the minimum to 0.65.2 (e.g.
"fastapi>=0.65.2,<1" or an equivalent exclusion of <0.65.2) so the project no
longer allows versions affected by the CSRF advisory; leave the uvicorn
constraint unchanged.

"llama-index-vector-stores-chroma>=0.5.0,<0.6.0",
"langchain-openai>=1.0.0,<2.0.0",
"google-generativeai>=0.8.3,<0.9.0",
Expand Down
43 changes: 43 additions & 0 deletions packages/sample-app/sample_app/fastapi_litellm_example.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
import os

import litellm
from dotenv import load_dotenv
from fastapi import FastAPI, HTTPException
from opentelemetry.sdk.trace.export import ConsoleSpanExporter
from pydantic import BaseModel

from traceloop.sdk import Traceloop
from traceloop.sdk.decorators import task, workflow

load_dotenv()

Traceloop.init(app_name="fastapi_litellm_example", disable_batch=True, exporter=ConsoleSpanExporter())

app = FastAPI()

class ChatRequest(BaseModel):
message: str

@task(name="call_llm")
def call_llm(message: str) -> str:
response = litellm.completion(
model=os.environ.get("LLM_MODEL", "openai/gpt-4o-mini"),
messages=[{"role": "user", "content": message}],
api_base=os.environ.get("LLM_API_BASE", None),
)
if not response.choices or not response.choices[0].message.content:
raise ValueError("Empty response from LLM")
return response.choices[0].message.content
Comment thread
coderabbitai[bot] marked this conversation as resolved.

@workflow(name="chat_workflow")
def chat_workflow(message: str) -> str:
return call_llm(message)

@app.post("/chat")
async def chat(request: ChatRequest):
try:
reply = chat_workflow(request.message)
except Exception as e:
raise HTTPException(status_code=502, detail=str(e))
return {"reply": reply}

Loading