Skip to content

Upgrading fastapi 0.135 to 0.136

Breaking0.135.4 → 0.136.3Breaking1Security1Platform1Changed22Other3

Full comparisonBack to fastapi
BreakingUpgrade verdict

1 breaking change and a platform requirement change and a security fix.

In plain terms
  • By default, FastAPI no longer treats headers written with underscores as if they used dashes, so requests sending underscore header names may stop matching.
  • FastAPI now works on the free-threaded build of Python 3.14, which can run code on multiple threads at once.
  • Adds the zizmor security tool for GitHub Actions and fixes the issues it found.
Must act 3 items need code or config changes

What you must change

Breaking1
Stops accepting underscore headers when convert_underscores=True, the default.
convert_underscores
0.136.3GitHub ReleaseSummarizedView source
Security1
Adds zizmor and fixes audit findings.
zizmor
0.136.1GitHub ReleaseSummarizedView source
Platform1
Adds support for free-threaded Python 3.14t.
0.136.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • added: class Color
  • added: class PyExtraColor
  • changed: field ServerSentEvent.event: Annotated[str | None, Doc('\n Optional event type name.\n\n Maps to `addEventListener(event, ...)` on the browser. When omitted,\n the browser dispatches on the generic `message` event.\n ')] → field ServerSentEvent.event: Annotated[str | None, AfterValidator(_check_event_single_line), Doc('\n Optional event type name.\n\n Maps to `addEventListener(event, ...)` on the browser. When omitted,\n the browser dispatches on the generic `message` event. Must be a\n single line.\n ')]
  • changed: field ServerSentEvent.id: Annotated[str | None, AfterValidator(_check_id_no_null), Doc('\n Optional event ID.\n\n The browser sends this value back as the `Last-Event-ID` header on\n automatic reconnection. **Must not contain null (`\\0`) characters.**\n ')] → field ServerSentEvent.id: Annotated[str | None, AfterValidator(_check_id_valid), Doc('\n Optional event ID.\n\n The browser sends this value back as the `Last-Event-ID` header on\n automatic reconnection. **Must be a single line** and must not contain\n null (`\\0`) characters.\n ')]