$ cat fastapi/week/2026-10-19.log
the week in review · Oct 19 – Oct 25, 2026
FastAPI ships six breaking releases in one week
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Parameter models now govern whole query, header, cookie, and form locations, and omitted form booleans no longer default to False.
0.155.0 fastapi/fastapi
The deprecated **extra keyword arguments are gone from Path, Query, Header, Cookie, Body, Form, and File, and unknown keyword arguments now raise TypeError. Anything still passing a custom keyword needs to move to json_schema_extra, as in Query(json_schema_extra={"custom": "value"}).
0.160.0 fastapi/fastapi
A parameter model's extra configuration now applies to every submitted field in that parameter location, matching Pydantic behavior, including fields declared in other models, individual parameters, and dependencies. Fields that previously escaped those settings now get them, so schemas and validation strictness can shift on code that did not change.
0.162.0 fastapi/fastapi
Omitted bool and bool | None form fields now take their declared defaults or fail as missing, the same as any other field; no more implicit False. A checkbox left unchecked now errors on a required field, so audit required booleans across individual form parameters, form models, and unions of form models.
0.150.0 fastapi/fastapi
Browsers submit an empty filename with empty content when nothing is selected; FastAPI now treats that as missing instead of a zero-byte upload, so required file fields raise a validation error and fields with defaults or default factories use them. Unselected inputs are ignored in lists of files. Handlers that tested for a zero-byte file are now checking a case that no longer arrives.
🗑️ Deprecate the `root_path` parameter in `FastAPI` fastapi/fastapi
The root_path argument to FastAPI() is deprecated in favor of configuring the server with fastapi run --root-path /api/v1. Apps that currently pass root_path in Python need to shift that setting to the run command; the paired change removed the deprecated openapi_prefix and the unused **extra from FastAPI itself.
✨ Add support for optional query, header, and cookie parameter models fastapi/fastapi
Optional query, header, and cookie parameter models let you declare a whole set of fields as one model that can itself be absent, rather than marking each field optional. The same treatment landed for form models. Aliases are now respected for these parameters, and AliasChoices was fixed for path parameters.
✨ Add WebSocket support to security dependencies (#10147) fastapi/fastapi
Security dependencies can now be attached to WebSocket routes, which previously had no equivalent of Depends-based security. The long tail also saw Pydantic fixes for a mypy plugin crash on a deferred empty model, infinite recursion with PydanticUseDefault on an invalid default, and a recursion guard in validate_strings().
$ ls fastapi/week/ # the briefings behind this review
Keep up with FastAPI & Pydantic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.