$ the-wire · showcase
FASTAPI TIGHTENS HEADER VALIDATION AND SSE SAFETY IN RAPID RELEASES
By RepoJournal · Filed · About FastAPI & Pydantic · Composed from the cited sources · methodology
1 person shipped this
FastAPI shipped two consecutive patches that enforce stricter HTTP header handling and validate Server Sent Event data to prevent malformed responses.
FastAPI 0.136.3 enforces a breaking change on header validation [3]: the framework now rejects underscores in header names by default when `convert_underscores=True`, accepting only hyphenated headers per HTTP spec [1]. This catches a subtle bug where applications could silently accept malformed headers. The preceding 0.136.2 release added validation to Server Sent Event fields [4], preventing applications from shipping broken SSE data that clients can't parse [2]. Both changes close gaps where FastAPI was too permissive, accepting invalid data that HTTP specs explicitly forbid. Documentation also landed for the `--entrypoint` CLI option in 0.136.2 [4]. A test cleanup in the pipeline removes duplicate engine disposal that was causing noise in the test suite [5].
Action items
- → Review header names in your API definitions before upgrading to 0.136.3 - replace underscores with hyphens fastapi/fastapi [plan]
- → Validate your SSE implementations if you're using Server Sent Events - ensure field data is properly formatted fastapi/fastapi [plan]
- → Upgrade to 0.136.3 as part of your next release cycle fastapi/fastapi [monitor]
References
- [1] ♻️ Do not accept underscore headers when using `convert_underscores=True` (the default) ↗ fastapi/fastapi
- [2] ♻️ Validate Server Sent Event fields to avoid applications from sending broken data ↗ fastapi/fastapi
- [3] 0.136.3 ↗ fastapi/fastapi
- [4] 0.136.2 ↗ fastapi/fastapi
- [5] ✅ Update tests, don't double dispose the engine ↗ fastapi/fastapi
