RepoJournal
FastAPI & Pydantic

FastAPI & Pydantic

FastAPI and the Pydantic + SQLModel async-Python stack

Keep up with FastAPI & Pydantic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

Topics: Python Full archive →

The Wire · Showcase

FASTAPI TIGHTENS HEADER VALIDATION AND SSE SAFETY IN RAPID RELEASES

By RepoJournal · Filed · About FastAPI & Pydantic

1 person shipped this

FastAPI shipped two consecutive patches that enforce stricter HTTP header handling and validate Server Sent Event data to prevent malformed responses.

FastAPI 0.136.3 enforces a breaking change on header validation [3]: the framework now rejects underscores in header names by default when `convert_underscores=True`, accepting only hyphenated headers per HTTP spec [1]. This catches a subtle bug where applications could silently accept malformed headers. The preceding 0.136.2 release added validation to Server Sent Event fields [4], preventing applications from shipping broken SSE data that clients can't parse [2]. Both changes close gaps where FastAPI was too permissive, accepting invalid data that HTTP specs explicitly forbid. Documentation also landed for the `--entrypoint` CLI option in 0.136.2 [4]. A test cleanup in the pipeline removes duplicate engine disposal that was causing noise in the test suite [5].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] ♻️ Do not accept underscore headers when using `convert_underscores=True` (the default) ↗ fastapi/fastapi
  2. [2] ♻️ Validate Server Sent Event fields to avoid applications from sending broken data ↗ fastapi/fastapi
  3. [3] 0.136.3 ↗ fastapi/fastapi
  4. [4] 0.136.2 ↗ fastapi/fastapi
  5. [5] ✅ Update tests, don't double dispose the engine ↗ fastapi/fastapi

Quick answers

What shipped in FastAPI & Pydantic on May 24, 2026?
FastAPI shipped two consecutive patches that enforce stricter HTTP header handling and validate Server Sent Event data to prevent malformed responses. In total, 7 commits, 5 pull requests, and 2 releases landed.
Who contributed to FastAPI & Pydantic on May 24, 2026?
1 developer shipped this update, including tiangolo.
What were the notable FastAPI & Pydantic updates?
♻️ Do not accept underscore headers when using `convert_underscores=True` (the default), ♻️ Validate Server Sent Event fields to avoid applications from sending broken data, and 0.136.3.

More from FastAPI & Pydantic

Daily updates, in your inbox

Follow FastAPI & Pydantic

Keep up with FastAPI & Pydantic in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

Want every project, not just this one?