FastAPI 0.160.0 has landed, and it changes how parameter models behave in request handling. Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, matching the behavior developers already expect from Pydantic itself. Previously, fields declared in other models, individual parameters, or dependencies were excluded from that configuration — a subtle inconsistency that could make validation outcomes depend on where a field happened to be declared rather than on the request payload.
The release notes flag this as a Breaking Change, so review your schemas before upgrading:
- Each parameter model's
extrasetting now propagates to sibling fields in the same parameter location (PR #16594 by @tiangolo). - With
extra="forbid", fields outside the model are now rejected — even if another parameter or dependency declares them. - With
extra="allow", those external fields are instead included as model extras. - With the default
extra="ignore", such fields are simply ignored, as before. - Internal maintenance:
certifiwas bumped from2026.1.4to2026.10.19(PR #16571 by @dependabot).
The practical implication is that the strictest extra mode now truly governs the whole parameter location. Applications relying on extra="forbid" while sharing field names across models, standalone parameters, or dependencies may start seeing validation errors where requests once succeeded. If your API accepts overlapping fields, either consolidate the declarations into one model or switch to extra="ignore" or extra="allow" depending on whether you want unexpected fields dropped or captured.
For teams building typed, contract-first APIs, the release is a win: parameter model configuration is now predictable and consistent with Pydantic, removing a class of surprising edge cases. Pin the upgrade, run your request-validation tests, and check any endpoint that mixes parameter models with independent parameters.
Source: https://github.com/fastapi/fastapi/releases/tag/0.160.0