Route guard monkeypatches FastAPI private internals with an unbounded fastapi>=0.115 pin #516

Tier 3: dependency risk

Problem

framework/hosting/simple_module_hosting/_route_guard.py depends on private API:

• fastapi.routing._IncludedRouter (line 37)
• original_router._get_routes_version() (line 71)
• starlette._utils.get_route_path (line 32)
• It also assigns over route.matches (line 97).

framework/{core,hosting}/pyproject.toml pin fastapi>=0.115 with no upper bound. The lockfile currently has 0.143.x.

The ImportError fallback only covers the class disappearing. If a private method is renamed, the result is an AttributeError at boot or on each request, triggered by an ordinary uv lock --upgrade.

Fix

• Add an upper bound (fastapi>=0.140,<0.150) so upgrades are deliberate.
• Add a contract test asserting the private symbols exist with the expected shape, so an upgrade PR fails with a clear message.
• Longer term, check whether FastAPI offers a public hook, or upstream one.