fastapi/fastapi
FastAPI framework, high performance, easy to learn, fast to code, ready for production
How fastapi is put together
This repository is FastAPI itself: a Python web framework for building APIs with standard type hints, built on top of Starlette (ASGI web layer) and Pydantic v2 (data validation/serialization). The core library lives in the `fastapi/` package, where `applications.py` defines the `FastAPI` app class (subclassing Starlette) that wires routing, OpenAPI schema generation, docs UIs (/docs, /redoc), middleware, and exception handlers; `routing.py` implements APIRouter/path-operation handling with dependency injection; `params.py`/`param_functions.py` define request parameter declarations (Query, Path, Body, Header, Cookie, File, Form, Depends, Security). Data flows from an ASGI server (uvicorn) through Starlette middleware into FastAPI's route handlers, which validate/convert inputs via Pydantic models generated from type hints, execute dependencies, serialize responses via `encoders.py`, and expose everything as an OpenAPI document. The repo also contains extensive documentation sources (`docs/`), runnable tutorial examples (`docs_src/`), tests, and CI scripts.
Languages
Frameworks
Infrastructure
Major components
fastapi.applications
Defines the FastAPI application class (Starlette subclass) that configures routes, OpenAPI/docs endpoints, middleware stack, exception handlers, and lifespan.
fastapi.routing
Implements APIRouter and path-operation decorators/handlers that resolve endpoints, run dependency injection, validate inputs, and build responses.
fastapi.params / param_functions
Declares request parameter types (Query, Path, Header, Cookie, Body, Form, File) and security/dependency markers (Depends, Security) extracted from function signatures.
fastapi.openapi
Generates the OpenAPI JSON schema and serves Swagger UI / ReDoc HTML pages (get_openapi, get_swagger_ui_html, get_redoc_html).
fastapi.encoders
Serializes Pydantic models, dataclasses, and other objects into JSON-compatible response payloads.
fastapi.exceptions / exception_handlers
Defines HTTPException, RequestValidationError, WebSocketRequestValidationError and default handlers converting them to JSON error responses.
fastapi.concurrency
Provides threadpool utilities (run_in_threadpool, contextmanager_in_threadpool) bridging sync code into async request handling via anyio.
fastapi.testclient / requests / websockets / sse
Request/WebSocket wrappers over Starlette plus an httpx-based test client and Server-Sent Events support used by apps and the test suite.
A quiet week dominated by refreshing outdated translations across a dozen languages.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A quiet week dominated by refreshing outdated translations across a dozen languages.
Week of 2026-08-10
Website polish and cleanup of legacy automation took center stage.
Week of 2026-08-03
A busy week of hardening automation security and updating dependencies.
Week of 2026-07-27
Three releases landed, including 0.141.0 with a new frontend-development helper plus several streaming and encoding bug fixes.
Week of 2026-07-20
Version 0.140.0 shipped with reduced memory usage, backed by a new benchmark.
Over the past five weeks the FastAPI project shipped a steady stream of releases, headlined by version 0.141.0's new `app.frontend()` convenience feature and a series of bug fixes for streaming responses and data encoding. Alongside product work, the team invested heavily in infrastructure: automating translations, tightening security around automated pull requests, and adding a memory benchmark to CI. The final weeks were quieter, focused on documentation polish, mobile-friendly site tweaks, and routine dependency updates.
Week by week
2026-08-17A quiet week dominated by refreshing outdated translations across a dozen languages.latest3 changes
Docs
Translation refresh for twelve languages
Documentation translations were updated to match recent changes in Hindi, Russian, Traditional Chinese, Ukrainian, German, Turkish, Japanese, French, Simplified Chinese, Spanish, Portuguese, and Korean.
Chore
Automated translation branch updates
The tooling that pushes translation pull requests was updated so branches stay current automatically.
Chore
Restored commit-in-place setting
A configuration option in the translation workflow was reverted to its previous behavior after being removed.
2026-08-10Website polish and cleanup of legacy automation took center stage.4 changes
Refactor
Conference section replaced with event banner
The conference listing on the website was swapped out for a simpler event banner, with better mobile layout.
Chore
Label automation migrated
Automatic labeling of issues and pull requests moved to the Latest Changes system, replacing an older label-checking process.
Fix
Security workflow branch fix
The security-scanning workflow pointed at the wrong branch name and was corrected.
Chore
Dependency bumps
Two internal tools (pymdown-extensions and gitpython) were updated to newer versions.
2026-08-03A busy week of hardening automation security and updating dependencies.6 changes
Fix
More secure automated pull requests
Automated workflows (translations, updates, pre-commit) switched from long-lived access tokens to GitHub's safer PR submission method.
Chore
GitHub CLI for Git authentication
Scripts that push commits now authenticate through the official GitHub command-line tool instead of stored credentials.
Chore
Major dependency upgrades
Roughly twenty packages were bumped, including a large jump in the cryptography library from 48.0.1 to 50.0.0.
Fix
Termynal control buttons fix
The interactive code-demo widgets on the docs site now use proper buttons, fixing their controls.
Chore
Old Latest Changes workflow retired
The previous release-notes automation pipeline was removed after its replacement proved stable.
Chore
Sponsor and topic repo lists refreshed
The auto-generated pages showing sponsors and community repositories using FastAPI were updated.
2026-07-27Three releases landed, including 0.141.0 with a new frontend-development helper plus several streaming and encoding bug fixes.6 changes
Feature
New app.frontend() helper (v0.141.0)
A new option makes local development more convenient when running `fastapi dev`, automatically detecting your frontend folder.
Fix
Frontend background tasks and headers fixed (v0.141.1)
Background tasks and custom headers coming from dependencies now work correctly with the new frontend integration.
Fix
Streaming status codes respected (v0.140.13)
Server-sent-event and JSON-lines endpoints now honor the HTTP status code you specify instead of ignoring it.
Fix
SSE line-splitting corrected (v0.140.12)
Event formatting now splits lines according to the server-sent-events specification, fixing malformed output.
Fix
Iterable return types honored (v0.140.11)
Response models are no longer ignored for regular endpoints that return iterable types like lists.
Chore
Regression testing against base code
Pull requests are now automatically tested against the unmodified codebase, with fixes to preserve test exit codes and catch any base failure as a regression.
2026-07-20Version 0.140.0 shipped with reduced memory usage, backed by a new benchmark.4 changes
Refactor
Lower memory usage in dependencies (v0.140.0)
How FastAPI tracks dependencies was optimized to use less memory, verified by a new continuous-integration memory benchmark.
Docs
Library Skills documentation added
New reference material was added describing FastAPI's skills for library usage.
Docs
Docs now use uv projects by default
All documentation examples and instructions were updated to use the modern uv project setup.
Docs
Broken links repaired
Various incorrect links throughout the documentation were fixed.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (3 advisories) across 204 scanned dependencies.
mcp 1.26.0
3 advisories. Fixed in 1.27.2.
How it can be abusedIf a server built with this MCP SDK exposes tasks or sessions over HTTP or WebSocket, any connected client could read, cancel, or hijack other clients' work because requests are not tied to the authenticated user and origins are not checked. This affects anyone running an MCP server that accepts multiple clients over the network; FastAPI itself does not use this package, so its own code is unaffected.
- highGHSA-hvrp-rf83-w775MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
- highGHSA-jpw9-pfvf-9f58MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- highGHSA-vj7q-gjh5-988wMCP Python SDK: WebSocket server transport does not support Host/Origin validation
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required