✅ Format test module docstring

[skip ci]

.github/labeler.yml

@@ -29,8 +29,6 @@ internal:
         - scripts/**
         - .gitignore
         - .pre-commit-config.yaml
-        - pdm_build.py
-        - requirements*.txt
         - uv.lock
         - docs/en/data/sponsors.yml
         - docs/en/overrides/main.html

.github/workflows/publish.yml

@@ -8,11 +8,6 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        package:
-          - fastapi
-          - fastapi-slim
     permissions:
       id-token: write
       contents: read
@@ -26,14 +21,9 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version-file: ".python-version"
-          # Issue ref: https://github.com/actions/setup-python/issues/436
-          # cache: "pip"
-          # cache-dependency-path: pyproject.toml
       - name: Install uv
         uses: astral-sh/setup-uv@v7
       - name: Build distribution
         run: uv build
-        env:
-          TIANGOLO_BUILD_PACKAGE: ${{ matrix.package }}
       - name: Publish
         run: uv publish

.github/workflows/test.yml

@@ -45,7 +45,7 @@ jobs:
   test:
     needs:
       - changes
-    if: needs.changes.outputs.src == 'true'
+    if: needs.changes.outputs.src == 'true' || github.ref == 'refs/heads/master'
     strategy:
       matrix:
         os: [ windows-latest, macos-latest ]
@@ -68,10 +68,8 @@ jobs:
             python-version: "3.13"
             coverage: coverage
             uv-resolution: highest
-            # Ubuntu with 3.13 needs coverage for CodSpeed benchmarks
           - os: ubuntu-latest
             python-version: "3.13"
-            coverage: coverage
             uv-resolution: highest
             codspeed: codspeed
           - os: ubuntu-latest
@@ -109,20 +107,10 @@ jobs:
         run: uv pip install "git+https://github.com/Kludex/starlette@main"
       - run: mkdir coverage
       - name: Test
-        if: matrix.codspeed != 'codspeed'
+        run: uv run --no-sync bash scripts/test-cov.sh
-        run: uv run --no-sync bash scripts/test.sh
         env:
           COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}
           CONTEXT: ${{ runner.os }}-py${{ matrix.python-version }}
-      - name: CodSpeed benchmarks
-        if: matrix.codspeed == 'codspeed'
-        uses: CodSpeedHQ/action@v4
-        env:
-            COVERAGE_FILE: coverage/.coverage.${{ runner.os }}-py${{ matrix.python-version }}
-            CONTEXT: ${{ runner.os }}-py${{ matrix.python-version }}
-        with:
-          mode: simulation
-          run: uv run --no-sync coverage run -m pytest tests/ --codspeed
       # Do not store coverage for all possible combinations to avoid file size max errors in Smokeshow
       - name: Store coverage files
         if: matrix.coverage == 'coverage'
@@ -132,6 +120,39 @@ jobs:
           path: coverage
           include-hidden-files: true
 
+  benchmark:
+    needs:
+      - changes
+    if: needs.changes.outputs.src == 'true' || github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON: "3.13"
+      UV_RESOLUTION: highest
+    steps:
+      - name: Dump GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+      - uses: actions/checkout@v6
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            pyproject.toml
+            uv.lock
+      - name: Install Dependencies
+        run: uv sync --no-dev --group tests --extra all
+      - name: CodSpeed benchmarks
+        uses: CodSpeedHQ/action@v4
+        with:
+          mode: simulation
+          run: uv run --no-sync pytest tests/benchmarks --codspeed
+
   coverage-combine:
     needs:
       - test
@@ -176,6 +197,7 @@ jobs:
     if: always()
     needs:
       - coverage-combine
+      - benchmark
     runs-on: ubuntu-latest
     steps:
       - name: Dump GitHub context
@@ -186,4 +208,4 @@ jobs:
         uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}
-          allowed-skips: coverage-combine,test
+          allowed-skips: coverage-combine,test,benchmark

docs/de/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ In der Produktion hätten Sie eine der oben genannten Optionen.
 
 Aber es ist der einfachste Weg, sich auf die Serverseite von WebSockets zu konzentrieren und ein funktionierendes Beispiel zu haben:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Einen `websocket` erstellen { #create-a-websocket }
 
 Erstellen Sie in Ihrer **FastAPI**-Anwendung einen `websocket`:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Technische Details
 
@@ -58,7 +58,7 @@ Sie könnten auch `from starlette.websockets import WebSocket` verwenden.
 
 In Ihrer WebSocket-Route können Sie Nachrichten `await`en und Nachrichten senden.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Sie können Binär-, Text- und JSON-Daten empfangen und senden.
 
@@ -109,7 +109,7 @@ In WebSocket-Endpunkten können Sie Folgendes aus `fastapi` importieren und verw
 
 Diese funktionieren auf die gleiche Weise wie für andere FastAPI-Endpunkte/*Pfadoperationen*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | Info
 
@@ -154,7 +154,7 @@ Damit können Sie den WebSocket verbinden und dann Nachrichten senden und empfan
 
 Wenn eine WebSocket-Verbindung geschlossen wird, löst `await websocket.receive_text()` eine `WebSocketDisconnect`-Exception aus, die Sie dann wie in folgendem Beispiel abfangen und behandeln können.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Zum Ausprobieren:
 

docs/en/docs/advanced/custom-response.md

@@ -1,6 +1,6 @@
 # Custom Response - HTML, Stream, File, others { #custom-response-html-stream-file-others }
 
-By default, **FastAPI** will return the responses using `JSONResponse`.
+By default, **FastAPI** will return JSON responses.
 
 You can override it by returning a `Response` directly as seen in [Return a Response directly](response-directly.md){.internal-link target=_blank}.
 
@@ -10,43 +10,27 @@ But you can also declare the `Response` that you want to be used (e.g. any `Resp
 
 The contents that you return from your *path operation function* will be put inside of that `Response`.
 
-And if that `Response` has a JSON media type (`application/json`), like is the case with the `JSONResponse` and `UJSONResponse`, the data you return will be automatically converted (and filtered) with any Pydantic `response_model` that you declared in the *path operation decorator*.
-
 /// note
 
 If you use a response class with no media type, FastAPI will expect your response to have no content, so it will not document the response format in its generated OpenAPI docs.
 
 ///
 
-## Use `ORJSONResponse` { #use-orjsonresponse }
+## JSON Responses { #json-responses }
 
-For example, if you are squeezing performance, you can install and use <a href="https://github.com/ijl/orjson" class="external-link" target="_blank">`orjson`</a> and set the response to be `ORJSONResponse`.
+By default FastAPI returns JSON responses.
 
-Import the `Response` class (sub-class) you want to use and declare it in the *path operation decorator*.
+If you declare a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} FastAPI will use it to serialize the data to JSON, using Pydantic.
 
-For large responses, returning a `Response` directly is much faster than returning a dictionary.
+If you don't declare a response model, FastAPI will use the `jsonable_encoder` explained in [JSON Compatible Encoder](../tutorial/encoder.md){.internal-link target=_blank} and put it in a `JSONResponse`.
 
-This is because by default, FastAPI will inspect every item inside and make sure it is serializable as JSON, using the same [JSON Compatible Encoder](../tutorial/encoder.md){.internal-link target=_blank} explained in the tutorial. This is what allows you to return **arbitrary objects**, for example database models.
+If you declare a `response_class` with a JSON media type (`application/json`), like is the case with the `JSONResponse`, the data you return will be automatically converted (and filtered) with any Pydantic `response_model` that you declared in the *path operation decorator*. But the data won't be serialized to JSON bytes with Pydantic, instead it will be converted with the `jsonable_encoder` and then passed to the `JSONResponse` class, which will serialize it to bytes using the standard JSON library in Python.
 
-But if you are certain that the content that you are returning is **serializable with JSON**, you can pass it directly to the response class and avoid the extra overhead that FastAPI would have by passing your return content through the `jsonable_encoder` before passing it to the response class.
+### JSON Performance { #json-performance }
 
-{* ../../docs_src/custom_response/tutorial001b_py310.py hl[2,7] *}
+In short, if you want the maximum performance, use a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} and don't declare a `response_class` in the *path operation decorator*.
 
-/// info
+{* ../../docs_src/response_model/tutorial001_01_py310.py ln[15:17] hl[16] *}
-
-The parameter `response_class` will also be used to define the "media type" of the response.
-
-In this case, the HTTP header `Content-Type` will be set to `application/json`.
-
-And it will be documented as such in OpenAPI.
-
-///
-
-/// tip
-
-The `ORJSONResponse` is only available in FastAPI, not in Starlette.
-
-///
 
 ## HTML Response { #html-response }
 
@@ -154,40 +138,6 @@ Takes some data and returns an `application/json` encoded response.
 
 This is the default response used in **FastAPI**, as you read above.
 
-### `ORJSONResponse` { #orjsonresponse }
-
-A fast alternative JSON response using <a href="https://github.com/ijl/orjson" class="external-link" target="_blank">`orjson`</a>, as you read above.
-
-/// info
-
-This requires installing `orjson` for example with `pip install orjson`.
-
-///
-
-### `UJSONResponse` { #ujsonresponse }
-
-An alternative JSON response using <a href="https://github.com/ultrajson/ultrajson" class="external-link" target="_blank">`ujson`</a>.
-
-/// info
-
-This requires installing `ujson` for example with `pip install ujson`.
-
-///
-
-/// warning
-
-`ujson` is less careful than Python's built-in implementation in how it handles some edge-cases.
-
-///
-
-{* ../../docs_src/custom_response/tutorial001_py310.py hl[2,7] *}
-
-/// tip
-
-It's possible that `ORJSONResponse` might be a faster alternative.
-
-///
-
 ### `RedirectResponse` { #redirectresponse }
 
 Returns an HTTP redirect. Uses a 307 status code (Temporary Redirect) by default.
@@ -268,7 +218,7 @@ In this case, you can return the file path directly from your *path operation* f
 
 You can create your own custom response class, inheriting from `Response` and using it.
 
-For example, let's say that you want to use <a href="https://github.com/ijl/orjson" class="external-link" target="_blank">`orjson`</a>, but with some custom settings not used in the included `ORJSONResponse` class.
+For example, let's say that you want to use <a href="https://github.com/ijl/orjson" class="external-link" target="_blank">`orjson`</a> with some settings.
 
 Let's say you want it to return indented and formatted JSON, so you want to use the orjson option `orjson.OPT_INDENT_2`.
 
@@ -292,13 +242,21 @@ Now instead of returning:
 
 Of course, you will probably find much better ways to take advantage of this than formatting JSON. 😉
 
+### `orjson` or Response Model { #orjson-or-response-model }
+
+If what you are looking for is performance, you are probably better off using a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} than an `orjson` response.
+
+With a response model, FastAPI will use Pydantic to serialize the data to JSON, without using intermediate steps, like converting it with `jsonable_encoder`, which would happen in any other case.
+
+And under the hood, Pydantic uses the same underlying Rust mechanisms as `orjson` to serialize to JSON, so you will already get the best performance with a response model.
+
 ## Default response class { #default-response-class }
 
 When creating a **FastAPI** class instance or an `APIRouter` you can specify which response class to use by default.
 
 The parameter that defines this is `default_response_class`.
 
-In the example below, **FastAPI** will use `ORJSONResponse` by default, in all *path operations*, instead of `JSONResponse`.
+In the example below, **FastAPI** will use `HTMLResponse` by default, in all *path operations*, instead of JSON.
 
 {* ../../docs_src/custom_response/tutorial010_py310.py hl[2,4] *}
 

docs/en/docs/advanced/json-base64-bytes.md

@@ -0,0 +1,63 @@
+# JSON with Bytes as Base64 { #json-with-bytes-as-base64 }
+
+If your app needs to receive and send JSON data, but you need to include binary data in it, you can encode it as base64.
+
+## Base64 vs Files { #base64-vs-files }
+
+Consider first if you can use [Request Files](../tutorial/request-files.md){.internal-link target=_blank} for uploading binary data and [Custom Response - FileResponse](./custom-response.md#fileresponse--fileresponse-){.internal-link target=_blank} for sending binary data, instead of encoding it in JSON.
+
+JSON can only contain UTF-8 encoded strings, so it can't contain raw bytes.
+
+Base64 can encode binary data in strings, but to do it, it needs to use more characters than the original binary data, so it would normally be less efficient than regular files.
+
+Use base64 only if you definitely need to include binary data in JSON, and you can't use files for that.
+
+## Pydantic `bytes` { #pydantic-bytes }
+
+You can declare a Pydantic model with `bytes` fields, and then use `val_json_bytes` in the model config to tell it to use base64 to *validate* input JSON data, as part of that validation it will decode the base64 string into bytes.
+
+{* ../../docs_src/json_base64_bytes/tutorial001_py310.py ln[1:9,29:35] hl[9] *}
+
+If you check the `/docs`, they will show that the field `data` expects base64 encoded bytes:
+
+<div class="screenshot">
+<img src="/img/tutorial/json-base64-bytes/image01.png">
+</div>
+
+You could send a request like:
+
+```json
+{
+    "description": "Some data",
+    "data": "aGVsbG8="
+}
+```
+
+/// tip
+
+`aGVsbG8=` is the base64 encoding of `hello`.
+
+///
+
+And then Pydantic will decode the base64 string and give you the original bytes in the `data` field of the model.
+
+You will receive a response like:
+
+```json
+{
+  "description": "Some data",
+  "content": "hello"
+}
+```
+
+## Pydantic `bytes` for Output Data { #pydantic-bytes-for-output-data }
+
+You can also use `bytes` fields with `ser_json_bytes` in the model config for output data, and Pydantic will *serialize* the bytes as base64 when generating the JSON response.
+
+{* ../../docs_src/json_base64_bytes/tutorial001_py310.py ln[1:2,12:16,29,38:41] hl[16] *}
+
+## Pydantic `bytes` for Input and Output Data { #pydantic-bytes-for-input-and-output-data }
+
+And of course, you can use the same model configured to use base64 to handle both input (*validate*) with `val_json_bytes` and output (*serialize*) with `ser_json_bytes` when receiving and sending JSON data.
+
+{* ../../docs_src/json_base64_bytes/tutorial001_py310.py ln[1:2,19:26,29,44:46] hl[23:26] *}

docs/en/docs/advanced/response-directly.md

@@ -2,19 +2,23 @@
 
 When you create a **FastAPI** *path operation* you can normally return any data from it: a `dict`, a `list`, a Pydantic model, a database model, etc.
 
-By default, **FastAPI** would automatically convert that return value to JSON using the `jsonable_encoder` explained in [JSON Compatible Encoder](../tutorial/encoder.md){.internal-link target=_blank}.
+If you declare a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} FastAPI will use it to serialize the data to JSON, using Pydantic.
 
-Then, behind the scenes, it would put that JSON-compatible data (e.g. a `dict`) inside of a `JSONResponse` that would be used to send the response to the client.
+If you don't declare a response model, FastAPI will use the `jsonable_encoder` explained in [JSON Compatible Encoder](../tutorial/encoder.md){.internal-link target=_blank} and put it in a `JSONResponse`.
 
-But you can return a `JSONResponse` directly from your *path operations*.
+You could also create a `JSONResponse` directly and return it.
 
-It might be useful, for example, to return custom headers or cookies.
+/// tip
+
+You will normally have much better performance using a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} than returning a `JSONResponse` directly, as that way it serializes the data using Pydantic, in Rust.
+
+///
 
 ## Return a `Response` { #return-a-response }
 
-In fact, you can return any `Response` or any sub-class of it.
+You can return any `Response` or any sub-class of it.
 
-/// tip
+/// info
 
 `JSONResponse` itself is a sub-class of `Response`.
 
@@ -56,6 +60,18 @@ You could put your XML content in a string, put that in a `Response`, and return
 
 {* ../../docs_src/response_directly/tutorial002_py310.py hl[1,18] *}
 
+## How a Response Model Works { #how-a-response-model-works }
+
+When you declare a [Response Model](../tutorial/response-model.md){.internal-link target=_blank} in a path operation, **FastAPI** will use it to serialize the data to JSON, using Pydantic.
+
+{* ../../docs_src/response_model/tutorial001_01_py310.py hl[16,21] *}
+
+As that will happen on the Rust side, the performance will be much better than if it was done with regular Python and the `JSONResponse` class.
+
+When using a response model FastAPI won't use the `jsonable_encoder` to convert the data (which would be slower) nor the `JSONResponse` class.
+
+Instead it takes the JSON bytes generated with Pydantic using the response model and returns a `Response` with the right media type for JSON directly (`application/json`).
+
 ## Notes { #notes }
 
 When you return a `Response` directly its data is not validated, converted (serialized), or documented automatically.

docs/en/docs/advanced/stream-data.md

@@ -0,0 +1,99 @@
+# Stream Data { #stream-data }
+
+If you want to stream data that can be structured as JSON, you should [Stream JSON Lines](../tutorial/stream-json-lines.md){.internal-link target=_blank}.
+
+But if you want to **stream pure binary data** or strings, here's how you can do it.
+
+## Use Cases { #use-cases }
+
+You could use this if you want to stream pure strings, for example directly from the output of an **AI LLM** service.
+
+You could also use it to stream **large binary files**, where you stream each chunk of data as you read it, without having to read it all in memory at once.
+
+You could also stream **video** or **audio** this way, it could even be generated as you process and send it.
+
+## A `StreamingResponse` with `yield` { #a-streamingresponse-with-yield }
+
+If you declare a `response_class=StreamingResponse` in your *path operation function*, you can use `yield` to send each chunk of data in turn.
+
+{* ../../docs_src/stream_data/tutorial001_py310.py ln[1:23] hl[20,23] *}
+
+FastAPI will give each chunk of data to the `StreamingResponse` as is, it won't try to convert it to JSON or anything similar.
+
+### Non-async *path operation functions* { #non-async-path-operation-functions }
+
+You can also use regular `def` functions (without `async`), and use `yield` the same way.
+
+{* ../../docs_src/stream_data/tutorial001_py310.py ln[26:29] hl[27] *}
+
+### No Annotation { #no-annotation }
+
+You don't really need to declare the return type annotation for streaming binary data.
+
+As FastAPI will not try to convert the data to JSON with Pydantic or serialize it in any way, in this case, the type annotation is only for your editor and tools to use, it won't be used by FastAPI.
+
+{* ../../docs_src/stream_data/tutorial001_py310.py ln[32:35] hl[33] *}
+
+This also means that with `StreamingResponse` you have the **freedom** and **responsibility** to produce and encode the data bytes exactly as you need them to be sent, independent of the type annotations. 🤓
+
+### Stream Bytes { #stream-bytes }
+
+One of the main use cases would be to stream `bytes` instead of strings, you can of course do it.
+
+{* ../../docs_src/stream_data/tutorial001_py310.py ln[44:47] hl[47] *}
+
+## A Custom `PNGStreamingResponse` { #a-custom-pngstreamingresponse }
+
+In the examples above, the data bytes were streamed, but the response didn't have a `Content-Type` header, so the client didn't know what type of data it was receiving.
+
+You can create a custom sub-class of `StreamingResponse` that sets the `Content-Type` header to the type of data you're streaming.
+
+For example, you can create a `PNGStreamingResponse` that sets the `Content-Type` header to `image/png` using the `media_type` attribute:
+
+{* ../../docs_src/stream_data/tutorial002_py310.py ln[6,19:20] hl[20] *}
+
+Then you can use this new class in `response_class=PNGStreamingResponse` in your *path operation function*:
+
+{* ../../docs_src/stream_data/tutorial002_py310.py ln[23:26] hl[23] *}
+
+### Simulate a File { #simulate-a-file }
+
+In this example, we are simulating a file with `io.BytesIO`, which is a file-like object that lives only in memory, but lets us use the same interface.
+
+For example, we can iterate over it to consume its contents, as we could with a file.
+
+{* ../../docs_src/stream_data/tutorial002_py310.py ln[1:26] hl[3,12:13,25] *}
+
+/// note | Technical Details
+
+The other two variables, `image_base64` and `binary_image`, are an image encoded in Base64, and then converted to bytes, to then pass it to `io.BytesIO`.
+
+Only so that it can live in the same file for this example and you can copy it and run it as is. 🥚
+
+///
+
+### Files and Async { #files-and-async }
+
+In most cases, file-like objects are not compatible with async and await by default.
+
+For example, they don't have an `await file.read()`, or `async for chunk in file`.
+
+And in many cases, reading them would be a blocking operation (that could block the event loop), because they are read from disk or from the network.
+
+/// info
+
+The example above is actually an exception, because the `io.BytesIO` object is already in memory, so reading it won't block anything.
+
+But in many cases reading a file or a file-like object would block.
+
+///
+
+To avoid blocking the event loop, you can simply declare the *path operation function* with regular `def` instead of `async def`, that way FastAPI will run it on a threadpool worker, to avoid blocking the main loop.
+
+{* ../../docs_src/stream_data/tutorial002_py310.py ln[29:32] hl[30] *}
+
+/// tip
+
+If you need to call blocking code from inside of an async function, or an async function from inside of a blocking function, you could use <a href="https://asyncer.tiangolo.com" class="external-link" target="_blank">Asyncer</a>, a sibling library to FastAPI.
+
+///

docs/en/docs/advanced/strict-content-type.md

@@ -0,0 +1,88 @@
+# Strict Content-Type Checking { #strict-content-type-checking }
+
+By default, **FastAPI** uses strict `Content-Type` header checking for JSON request bodies, this means that JSON requests **must** include a valid `Content-Type` header (e.g. `application/json`) in order for the body to be parsed as JSON.
+
+## CSRF Risk { #csrf-risk }
+
+This default behavior provides protection against a class of **Cross-Site Request Forgery (CSRF)** attacks in a very specific scenario.
+
+These attacks exploit the fact that browsers allow scripts to send requests without doing any CORS preflight check when they:
+
+* don't have a `Content-Type` header (e.g. using `fetch()` with a `Blob` body)
+* and don't send any authentication credentials.
+
+This type of attack is mainly relevant when:
+
+* the application is running locally (e.g. on `localhost`) or in an internal network
+* and the application doesn't have any authentication, it expects that any request from the same network can be trusted.
+
+## Example Attack { #example-attack }
+
+Imagine you build a way to run a local AI agent.
+
+It provides an API at
+
+```
+http://localhost:8000/v1/agents/multivac
+```
+
+There's also a frontend at
+
+```
+http://localhost:8000
+```
+
+/// tip
+
+Note that both have the same host.
+
+///
+
+Then using the frontend you can make the AI agent do things on your behalf.
+
+As it's running **locally**, and not in the open internet, you decide to **not have any authentication** set up, just trusting the access to the local network.
+
+Then one of your users could install it and run it locally.
+
+Then they could open a malicious website, e.g. something like
+
+```
+https://evilhackers.example.com
+```
+
+And that malicious website sends requests using `fetch()` with a `Blob` body to the local API at
+
+```
+http://localhost:8000/v1/agents/multivac
+```
+
+Even though the host of the malicious website and the local app is different, the browser won't trigger a CORS preflight request because:
+
+* It's running without any authentication, it doesn't have to send any credentials.
+* The browser thinks it's not sending JSON (because of the missing `Content-Type` header).
+
+Then the malicious website could make the local AI agent send angry messages to the user's ex-boss... or worse. 😅
+
+## Open Internet { #open-internet }
+
+If your app is in the open internet, you wouldn't "trust the network" and let anyone send privileged requests without authentication.
+
+Attackers could simply run a script to send requests to your API, no need for browser interaction, so you are probably already securing any privileged endpoints.
+
+In that case **this attack / risk doesn't apply to you**.
+
+This risk and attack is mainly relevant when the app runs on the **local network** and that is the **only assumed protection**.
+
+## Allowing Requests Without Content-Type { #allowing-requests-without-content-type }
+
+If you need to support clients that don't send a `Content-Type` header, you can disable strict checking by setting `strict_content_type=False`:
+
+{* ../../docs_src/strict_content_type/tutorial001_py310.py hl[4] *}
+
+With this setting, requests without a `Content-Type` header will have their body parsed as JSON, which is the same behavior as older versions of FastAPI.
+
+/// info
+
+This behavior and configuration was added in FastAPI 0.132.0.
+
+///

docs/en/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ In production you would have one of the options above.
 
 But it's the simplest way to focus on the server-side of WebSockets and have a working example:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Create a `websocket` { #create-a-websocket }
 
 In your **FastAPI** application, create a `websocket`:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Technical Details
 
@@ -58,7 +58,7 @@ You could also use `from starlette.websockets import WebSocket`.
 
 In your WebSocket route you can `await` for messages and send messages.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 You can receive and send binary, text, and JSON data.
 
@@ -109,7 +109,7 @@ In WebSocket endpoints you can import from `fastapi` and use:
 
 They work the same way as for other FastAPI endpoints/*path operations*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info
 
@@ -154,7 +154,7 @@ With that you can connect the WebSocket and then send and receive messages:
 
 When a WebSocket connection is closed, the `await websocket.receive_text()` will raise a `WebSocketDisconnect` exception, which you can then catch and handle like in this example.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 To try it out:
 

docs/en/docs/how-to/general.md

@@ -6,6 +6,10 @@ Here are several pointers to other places in the docs, for general or frequent q
 
 To ensure that you don't return more data than you should, read the docs for [Tutorial - Response Model - Return Type](../tutorial/response-model.md){.internal-link target=_blank}.
 
+## Optimize Response Performance - Response Model - Return Type { #optimize-response-performance-response-model-return-type }
+
+To optimize performance when returning JSON data, use a return type or response model, that way Pydantic will handle the serialization to JSON on the Rust side, without going through Python. Read more in the docs for [Tutorial - Response Model - Return Type](../tutorial/response-model.md){.internal-link target=_blank}.
+
 ## Documentation Tags - OpenAPI { #documentation-tags-openapi }
 
 To add tags to your *path operations*, and group them in the docs UI, read the docs for [Tutorial - Path Operation Configurations - Tags](../tutorial/path-operation-configuration.md#tags){.internal-link target=_blank}.

docs/en/docs/reference/responses.md

@@ -22,7 +22,13 @@ from fastapi.responses import (
 
 ## FastAPI Responses
 
-There are a couple of custom FastAPI response classes, you can use them to optimize JSON performance.
+There were a couple of custom FastAPI response classes that were intended to optimize JSON performance.
+
+However, they are now deprecated as you will now get better performance by using a [Response Model - Return Type](https://fastapi.tiangolo.com/tutorial/response-model/).
+
+That way, Pydantic will serialize the data into JSON bytes on the Rust side, which will achieve better performance than these custom JSON responses.
+
+Read more about it in [Custom Response - HTML, Stream, File, others - `orjson` or Response Model](https://fastapi.tiangolo.com/advanced/custom-response/#orjson-or-response-model).
 
 ::: fastapi.responses.UJSONResponse
     options:

docs/en/docs/release-notes.md

@@ -7,6 +7,84 @@ hide:
 
 ## Latest Changes
 
+### Internal
+
+* 🔨 Run tests with `pytest-xdist` and `pytest-cov`. PR [#14992](https://github.com/fastapi/fastapi/pull/14992) by [@YuriiMotov](https://github.com/YuriiMotov).
+
+## 0.133.1
+
+### Features
+
+* 🔧 Add FastAPI Agents Skill. PR [#14982](https://github.com/fastapi/fastapi/pull/14982) by [@tiangolo](https://github.com/tiangolo).
+    * Read more about it in [Library Agent Skills](https://tiangolo.com/ideas/library-agent-skills/).
+
+### Internal
+
+* ✅ Fix all tests are skipped on Windows. PR [#14994](https://github.com/fastapi/fastapi/pull/14994) by [@YuriiMotov](https://github.com/YuriiMotov).
+
+## 0.133.0
+
+### Upgrades
+
+* ⬆️ Add support for Starlette 1.0.0+. PR [#14987](https://github.com/fastapi/fastapi/pull/14987) by [@tiangolo](https://github.com/tiangolo).
+
+## 0.132.1
+
+### Refactors
+
+* ♻️ Refactor logic to handle OpenAPI and Swagger UI escaping data. PR [#14986](https://github.com/fastapi/fastapi/pull/14986) by [@tiangolo](https://github.com/tiangolo).
+
+### Internal
+
+* 👥 Update FastAPI People - Experts. PR [#14972](https://github.com/fastapi/fastapi/pull/14972) by [@tiangolo](https://github.com/tiangolo).
+* 👷 Allow skipping `benchmark` job in `test` workflow. PR [#14974](https://github.com/fastapi/fastapi/pull/14974) by [@YuriiMotov](https://github.com/YuriiMotov).
+
+## 0.132.0
+
+### Breaking Changes
+
+* 🔒️ Add `strict_content_type` checking for JSON requests. PR [#14978](https://github.com/fastapi/fastapi/pull/14978) by [@tiangolo](https://github.com/tiangolo).
+    * Now FastAPI checks, by default, that JSON requests have a `Content-Type` header with a valid JSON value, like `application/json`, and rejects requests that don't.
+    * If the clients for your app don't send a valid `Content-Type` header you can disable this with `strict_content_type=False`.
+    * Check the new docs: [Strict Content-Type Checking](https://fastapi.tiangolo.com/advanced/strict-content-type/).
+
+### Internal
+
+* ⬆ Bump flask from 3.1.2 to 3.1.3. PR [#14949](https://github.com/fastapi/fastapi/pull/14949) by [@dependabot[bot]](https://github.com/apps/dependabot).
+* ⬆ Update all dependencies to use `griffelib` instead of `griffe`. PR [#14973](https://github.com/fastapi/fastapi/pull/14973) by [@svlandeg](https://github.com/svlandeg).
+* 🔨 Fix `FastAPI People` workflow. PR [#14951](https://github.com/fastapi/fastapi/pull/14951) by [@YuriiMotov](https://github.com/YuriiMotov).
+* 👷 Do not run codspeed with coverage as it's not tracked. PR [#14966](https://github.com/fastapi/fastapi/pull/14966) by [@tiangolo](https://github.com/tiangolo).
+* 👷 Do not include benchmark tests in coverage to speed up coverage processing. PR [#14965](https://github.com/fastapi/fastapi/pull/14965) by [@tiangolo](https://github.com/tiangolo).
+
+## 0.131.0
+
+### Breaking Changes
+
+* 🗑️ Deprecate `ORJSONResponse` and `UJSONResponse`. PR [#14964](https://github.com/fastapi/fastapi/pull/14964) by [@tiangolo](https://github.com/tiangolo).
+
+## 0.130.0
+
+### Features
+
+* ✨ Serialize JSON response with Pydantic (in Rust), when there's a Pydantic return type or response model. PR [#14962](https://github.com/fastapi/fastapi/pull/14962) by [@tiangolo](https://github.com/tiangolo).
+    * This results in 2x (or more) performance increase for JSON responses.
+    * New docs: [Custom Response - JSON Performance](https://fastapi.tiangolo.com/advanced/custom-response/#json-performance).
+
+## 0.129.2
+
+### Internal
+
+* ⬆️ Upgrade pytest. PR [#14959](https://github.com/fastapi/fastapi/pull/14959) by [@tiangolo](https://github.com/tiangolo).
+* 👷 Fix CI, do not attempt to publish `fastapi-slim`. PR [#14958](https://github.com/fastapi/fastapi/pull/14958) by [@tiangolo](https://github.com/tiangolo).
+* ➖ Drop support for `fastapi-slim`, no more versions will be released, use only `"fastapi[standard]"` or `fastapi`. PR [#14957](https://github.com/fastapi/fastapi/pull/14957) by [@tiangolo](https://github.com/tiangolo).
+* 🔧 Update pyproject.toml, remove unneeded lines. PR [#14956](https://github.com/fastapi/fastapi/pull/14956) by [@tiangolo](https://github.com/tiangolo).
+
+## 0.129.1
+
+### Fixes
+
+* ♻️ Fix JSON Schema for bytes, use `"contentMediaType": "application/octet-stream"` instead of `"format": "binary"`. PR [#14953](https://github.com/fastapi/fastapi/pull/14953) by [@tiangolo](https://github.com/tiangolo).
+
 ### Docs
 
 * 🔨 Add Kapa.ai widget (AI chatbot). PR [#14938](https://github.com/fastapi/fastapi/pull/14938) by [@tiangolo](https://github.com/tiangolo).
@@ -31,6 +109,7 @@ hide:
 
 ### Internal
 
+* 👷 Always run tests on push to `master` branch and when run by scheduler. PR [#14940](https://github.com/fastapi/fastapi/pull/14940) by [@YuriiMotov](https://github.com/YuriiMotov).
 * 🎨 Upgrade typing syntax for Python 3.10. PR [#14932](https://github.com/fastapi/fastapi/pull/14932) by [@tiangolo](https://github.com/tiangolo).
 * ⬆ Bump cryptography from 46.0.4 to 46.0.5. PR [#14892](https://github.com/fastapi/fastapi/pull/14892) by [@dependabot[bot]](https://github.com/apps/dependabot).
 * ⬆ Bump pillow from 12.1.0 to 12.1.1. PR [#14899](https://github.com/fastapi/fastapi/pull/14899) by [@dependabot[bot]](https://github.com/apps/dependabot).

docs/en/docs/tutorial/response-model.md

@@ -13,6 +13,7 @@ FastAPI will use this return type to:
 * Add a **JSON Schema** for the response, in the OpenAPI *path operation*.
     * This will be used by the **automatic docs**.
     * It will also be used by automatic client code generation tools.
+* **Serialize** the returned data to JSON using Pydantic, which is written in **Rust**, so it will be **much faster**.
 
 But most importantly:
 

docs/en/docs/tutorial/stream-json-lines.md

@@ -0,0 +1,105 @@
+# Stream JSON Lines { #stream-json-lines }
+
+You could have a sequence of data that you would like to send in a "**stream**", you could do it with **JSON Lines**.
+
+## What is a Stream? { #what-is-a-stream }
+
+"**Streaming**" data means that your app will start sending data items to the client without waiting for the entire sequence of items to be ready.
+
+So, it will send the first item, the client will receive and start processing it, and you might still be producing the next item.
+
+```mermaid
+sequenceDiagram
+    participant App
+    participant Client
+
+    App->>App: Produce Item 1
+    App->>Client: Send Item 1
+    App->>App: Produce Item 2
+    Client->>Client: Process Item 1
+    App->>Client: Send Item 2
+    App->>App: Produce Item 3
+    Client->>Client: Process Item 2
+    App->>Client: Send Item 3
+    Client->>Client: Process Item 3
+    Note over App: Keeps producing...
+    Note over Client: Keeps consuming...
+```
+
+It could even be an infinite stream, where you keep sending data.
+
+## JSON Lines { #json-lines }
+
+In these cases, it's common to send "**JSON Lines**", which is a format where you send one JSON object per line.
+
+A response would have a content type of `application/jsonl` (instead of `application/json`) and the body would be something like:
+
+```json
+{"name": "Plumbus", "description": "A multi-purpose household device."}
+{"name": "Portal Gun", "description": "A portal opening device."}
+{"name": "Meeseeks Box", "description": "A box that summons a Meeseeks."}
+```
+
+It's very similar to a JSON array (equivalent of a Python list), but instead of being wrapped in `[]` and having `,` between the items, it has **one JSON object per line**, they are separated by a new line character.
+
+/// info
+
+The important point is that your app will be able to produce each line in turn, while the client consumes the previous lines.
+
+///
+
+/// note | Technical Details
+
+Because each JSON object will be separated by a new line, they can't contain literal new line characters in their content, but they can contain escaped new lines (`\n`), which is part of the JSON standard.
+
+But normally you won't have to worry about it, it's done automatically, continue reading. 🤓
+
+///
+
+## Use Cases { #use-cases }
+
+You could use this to stream data from an **AI LLM** service, from **logs** or **telemetry**, or from other types of data that can be structured in **JSON** items.
+
+/// tip
+
+If you want to stream binary data, for example video or audio, check the advanced guide: [Stream Data](../advanced/stream-data.md).
+
+///
+
+## Stream JSON Lines with FastAPI { #stream-json-lines-with-fastapi }
+
+To stream JSON Lines with FastAPI you can, instead of using `return` in your *path operation function*, use `yield` to produce each item in turn.
+
+{* ../../docs_src/stream_json_lines/tutorial001_py310.py ln[1:24] hl[24] *}
+
+If each JSON item you want to send back is of type `Item` (a Pydantic model) and it's an async function, you can declare the return type as `AsyncIterable[Item]`:
+
+{* ../../docs_src/stream_json_lines/tutorial001_py310.py ln[1:24] hl[9:11,22] *}
+
+If you declare the return type, FastAPI will use it to **validate** the data, **document** it in OpenAPI, **filter** it, and **serialize** it using Pydantic.
+
+/// tip
+
+As Pydantic will serialize it in the **Rust** side, you will get much higher **performance** than if you don't declare a return type.
+
+///
+
+### Non-async *path operation functions* { #non-async-path-operation-functions }
+
+You can also use regular `def` functions (without `async`), and use `yield` the same way.
+
+FastAPI will make sure it's run correctly so that it doesn't block the event loop.
+
+As in this case the function is not async, the right return type would be `Iterable[Item]`:
+
+{* ../../docs_src/stream_json_lines/tutorial001_py310.py ln[27:30] hl[28] *}
+
+### No Return Type { #no-return-type }
+
+You can also omit the return type. FastAPI will then use the [`jsonable_encoder`](./encoder.md){.internal-link target=_blank} to convert the data to something that can be serialized to JSON and then send it as JSON Lines.
+
+{* ../../docs_src/stream_json_lines/tutorial001_py310.py ln[33:36] hl[34] *}
+
+## Server Sent Events (SSE) { #server-sent-events-sse }
+
+A future version of FastAPI will also have first-class support for Server Sent Events (SSE), which are quite similar, but with a couple of extra details. 🤓

docs/en/mkdocs.yml

@@ -154,6 +154,7 @@ nav:
     - tutorial/cors.md
     - tutorial/sql-databases.md
     - tutorial/bigger-applications.md
+    - tutorial/stream-json-lines.md
     - tutorial/background-tasks.md
     - tutorial/metadata.md
     - tutorial/static-files.md
@@ -161,6 +162,7 @@ nav:
     - tutorial/debugging.md
   - Advanced User Guide:
     - advanced/index.md
+    - advanced/stream-data.md
     - advanced/path-operation-advanced-configuration.md
     - advanced/additional-status-codes.md
     - advanced/response-directly.md
@@ -192,6 +194,8 @@ nav:
     - advanced/wsgi.md
     - advanced/generate-clients.md
     - advanced/advanced-python-types.md
+    - advanced/json-base64-bytes.md
+    - advanced/strict-content-type.md
   - fastapi-cli.md
   - Deployment:
     - deployment/index.md

docs/es/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ En producción tendrías una de las opciones anteriores.
 
 Pero es la forma más sencilla de enfocarse en el lado del servidor de WebSockets y tener un ejemplo funcional:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Crear un `websocket` { #create-a-websocket }
 
 En tu aplicación de **FastAPI**, crea un `websocket`:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Detalles Técnicos
 
@@ -58,7 +58,7 @@ También podrías usar `from starlette.websockets import WebSocket`.
 
 En tu ruta de WebSocket puedes `await` para recibir mensajes y enviar mensajes.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Puedes recibir y enviar datos binarios, de texto y JSON.
 
@@ -109,7 +109,7 @@ En endpoints de WebSocket puedes importar desde `fastapi` y usar:
 
 Funcionan de la misma manera que para otros endpoints de FastAPI/*path operations*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | Información
 
@@ -154,7 +154,7 @@ Con eso puedes conectar el WebSocket y luego enviar y recibir mensajes:
 
 Cuando una conexión de WebSocket se cierra, el `await websocket.receive_text()` lanzará una excepción `WebSocketDisconnect`, que puedes capturar y manejar como en este ejemplo.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Para probarlo:
 

docs/fr/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ En production, vous auriez l'une des options ci-dessus.
 
 Mais c'est la façon la plus simple de se concentrer sur la partie serveur des WebSockets et d'avoir un exemple fonctionnel :
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Créer un `websocket` { #create-a-websocket }
 
 Dans votre application **FastAPI**, créez un `websocket` :
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Détails techniques
 
@@ -58,7 +58,7 @@ Vous pourriez aussi utiliser `from starlette.websockets import WebSocket`.
 
 Dans votre route WebSocket, vous pouvez `await` des messages et envoyer des messages.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Vous pouvez recevoir et envoyer des données binaires, texte et JSON.
 
@@ -109,7 +109,7 @@ Dans les endpoints WebSocket, vous pouvez importer depuis `fastapi` et utiliser
 
 Ils fonctionnent de la même manière que pour les autres endpoints/*chemins d'accès* FastAPI :
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info
 
@@ -154,7 +154,7 @@ Avec cela, vous pouvez connecter le WebSocket puis envoyer et recevoir des messa
 
 Lorsqu'une connexion WebSocket est fermée, l'instruction `await websocket.receive_text()` lèvera une exception `WebSocketDisconnect`, que vous pouvez ensuite intercepter et gérer comme dans cet exemple.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Pour l'essayer :
 

docs/ja/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 しかし、これはWebSocketsのサーバーサイドに焦点を当て、動作する例を示す最も簡単な方法です。
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## `websocket` を作成する { #create-a-websocket }
 
 **FastAPI** アプリケーションで、`websocket` を作成します。
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | 技術詳細
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 WebSocketルートでは、メッセージを待機して送信するために `await` を使用できます。
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 バイナリやテキストデータ、JSONデータを送受信できます。
 
@@ -109,7 +109,7 @@ WebSocketエンドポイントでは、`fastapi` から以下をインポート
 
 これらは、他のFastAPI エンドポイント/*path operations* の場合と同じように機能します。
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | 情報
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 WebSocket接続が閉じられると、 `await websocket.receive_text()` は例外 `WebSocketDisconnect` を発生させ、この例のようにキャッチして処理することができます。
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 試してみるには、
 

docs/ko/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 그러나 이는 WebSockets의 서버 측에 집중하고 동작하는 예제를 제공하는 가장 간단한 방법입니다:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## `websocket` 생성하기 { #create-a-websocket }
 
 **FastAPI** 애플리케이션에서 `websocket`을 생성합니다:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | 기술 세부사항
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 WebSocket 경로에서 메시지를 대기(`await`)하고 전송할 수 있습니다.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 여러분은 이진 데이터, 텍스트, JSON 데이터를 받을 수 있고 전송할 수 있습니다.
 
@@ -109,7 +109,7 @@ WebSocket 엔드포인트에서 `fastapi`에서 다음을 가져와 사용할
 
 이들은 다른 FastAPI 엔드포인트/*경로 처리*와 동일하게 동작합니다:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | 정보
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 WebSocket 연결이 닫히면, `await websocket.receive_text()`가 `WebSocketDisconnect` 예외를 발생시킵니다. 그러면 이 예제처럼 이를 잡아 처리할 수 있습니다.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 테스트해보기:
 

docs/pt/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ Na produção, você teria uma das opções acima.
 
 Mas é a maneira mais simples de focar no lado do servidor de WebSockets e ter um exemplo funcional:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Crie um `websocket` { #create-a-websocket }
 
 Em sua aplicação **FastAPI**, crie um `websocket`:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Detalhes Técnicos
 
@@ -58,7 +58,7 @@ A **FastAPI** fornece o mesmo `WebSocket` diretamente apenas como uma conveniên
 
 Em sua rota WebSocket você pode esperar (`await`) por mensagens e enviar mensagens.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Você pode receber e enviar dados binários, de texto e JSON.
 
@@ -109,7 +109,7 @@ Nos endpoints WebSocket você pode importar do `fastapi` e usar:
 
 Eles funcionam da mesma forma que para outros endpoints FastAPI/*operações de rota*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | Informação
 
@@ -154,7 +154,7 @@ Com isso você pode conectar o WebSocket e então enviar e receber mensagens:
 
 Quando uma conexão WebSocket é fechada, o `await websocket.receive_text()` levantará uma exceção `WebSocketDisconnect`, que você pode então capturar e lidar como neste exemplo.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Para testar:
 

docs/ru/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 Для примера нам нужен наиболее простой способ, который позволит сосредоточиться на серверной части веб‑сокетов и получить рабочий код:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Создание `websocket` { #create-a-websocket }
 
 Создайте `websocket` в своем **FastAPI** приложении:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Технические детали
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 Через эндпоинт веб-сокета вы можете получать и отправлять сообщения.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Вы можете получать и отправлять двоичные, текстовые и JSON данные.
 
@@ -109,7 +109,7 @@ $ fastapi dev main.py
 
 Они работают так же, как и в других FastAPI эндпоинтах/*операциях пути*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | Примечание
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 Если веб-сокет соединение закрыто, то `await websocket.receive_text()` вызовет исключение `WebSocketDisconnect`, которое можно поймать и обработать как в этом примере:
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Чтобы воспроизвести пример:
 

docs/tr/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ Production'da yukarıdaki seçeneklerden birini kullanırsınız.
 
 Ama WebSockets'in server tarafına odaklanmak ve çalışan bir örnek görmek için en basit yol bu:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Bir `websocket` Oluşturun { #create-a-websocket }
 
 **FastAPI** uygulamanızda bir `websocket` oluşturun:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Teknik Detaylar
 
@@ -58,7 +58,7 @@ Ama WebSockets'in server tarafına odaklanmak ve çalışan bir örnek görmek i
 
 WebSocket route'unuzda mesajları `await` edebilir ve mesaj gönderebilirsiniz.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Binary, text ve JSON verisi alıp gönderebilirsiniz.
 
@@ -109,7 +109,7 @@ WebSocket endpoint'lerinde `fastapi` içinden import edip şunları kullanabilir
 
 Diğer FastAPI endpoint'leri/*path operations* ile aynı şekilde çalışırlar:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info | Bilgi
 
@@ -154,7 +154,7 @@ Bununla WebSocket'e bağlanabilir, ardından mesaj gönderip alabilirsiniz:
 
 Bir WebSocket bağlantısı kapandığında, `await websocket.receive_text()` bir `WebSocketDisconnect` exception'ı raise eder; ardından bunu bu örnekteki gibi yakalayıp (catch) yönetebilirsiniz.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Denemek için:
 

docs/uk/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 Але це найпростіший спосіб зосередитися на серверній частині WebSockets і мати робочий приклад:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## Створіть `websocket` { #create-a-websocket }
 
 У вашому застосунку **FastAPI** створіть `websocket`:
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | Технічні деталі
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 У вашому маршруті WebSocket ви можете `await` повідомлення і надсилати повідомлення.
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 Ви можете отримувати та надсилати бінарні, текстові та JSON-дані.
 
@@ -109,7 +109,7 @@ $ fastapi dev main.py
 
 Вони працюють так само, як для інших ендпойнтів FastAPI/*операцій шляху*:
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 Коли з'єднання WebSocket закривається, `await websocket.receive_text()` підніме виняток `WebSocketDisconnect`, який ви можете перехопити й обробити, як у цьому прикладі.
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 Щоб спробувати:
 

docs/zh-hant/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 但這是能讓我們專注於 WebSocket 伺服端並跑起一個可運作範例的最簡單方式：
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## 建立一個 `websocket` { #create-a-websocket }
 
 在你的 **FastAPI** 應用中，建立一個 `websocket`：
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | 技術細節
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 在你的 WebSocket 路由中，你可以 `await` 接收訊息並傳送訊息。
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 你可以接收與傳送二進位、文字與 JSON 資料。
 
@@ -109,7 +109,7 @@ $ fastapi dev main.py
 
 它們的運作方式與其他 FastAPI 端點/*路徑操作* 相同：
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 當 WebSocket 連線關閉時，`await websocket.receive_text()` 會拋出 `WebSocketDisconnect` 例外，你可以像範例中那樣捕捉並處理。
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 試用方式：
 

docs/zh/docs/advanced/websockets.md

@@ -38,13 +38,13 @@ $ pip install websockets
 
 但这是一种专注于 WebSockets 的服务器端并提供一个工作示例的最简单方式：
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[2,6:38,41:43] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[2,6:38,41:43] *}
 
 ## 创建 `websocket` { #create-a-websocket }
 
 在您的 **FastAPI** 应用程序中，创建一个 `websocket`：
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[1,46:47] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[1,46:47] *}
 
 /// note | 技术细节
 
@@ -58,7 +58,7 @@ $ pip install websockets
 
 在您的 WebSocket 路由中，您可以使用 `await` 等待消息并发送消息。
 
-{* ../../docs_src/websockets/tutorial001_py310.py hl[48:52] *}
+{* ../../docs_src/websockets_/tutorial001_py310.py hl[48:52] *}
 
 您可以接收和发送二进制、文本和 JSON 数据。
 
@@ -109,7 +109,7 @@ $ fastapi dev main.py
 
 它们的工作方式与其他 FastAPI 端点/*路径操作* 相同：
 
-{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}
+{* ../../docs_src/websockets_/tutorial002_an_py310.py hl[68:69,82] *}
 
 /// info
 
@@ -154,7 +154,7 @@ $ fastapi dev main.py
 
 当 WebSocket 连接关闭时，`await websocket.receive_text()` 将引发 `WebSocketDisconnect` 异常，您可以捕获并处理该异常，就像本示例中的示例一样。
 
-{* ../../docs_src/websockets/tutorial003_py310.py hl[79:81] *}
+{* ../../docs_src/websockets_/tutorial003_py310.py hl[79:81] *}
 
 尝试以下操作：
 

docs_src/custom_response/tutorial010_py310.py

@@ -1,9 +1,9 @@
 from fastapi import FastAPI
-from fastapi.responses import ORJSONResponse
+from fastapi.responses import HTMLResponse
 
-app = FastAPI(default_response_class=ORJSONResponse)
+app = FastAPI(default_response_class=HTMLResponse)
 
 
 @app.get("/items/")
 async def read_items():
-    return [{"item_id": "Foo"}]
+    return "<h1>Items</h1><p>This is a list of items.</p>"

docs_src/json_base64_bytes/tutorial001_py310.py

@@ -0,0 +1,46 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+
+class DataInput(BaseModel):
+    description: str
+    data: bytes
+
+    model_config = {"val_json_bytes": "base64"}
+
+
+class DataOutput(BaseModel):
+    description: str
+    data: bytes
+
+    model_config = {"ser_json_bytes": "base64"}
+
+
+class DataInputOutput(BaseModel):
+    description: str
+    data: bytes
+
+    model_config = {
+        "val_json_bytes": "base64",
+        "ser_json_bytes": "base64",
+    }
+
+
+app = FastAPI()
+
+
+@app.post("/data")
+def post_data(body: DataInput):
+    content = body.data.decode("utf-8")
+    return {"description": body.description, "content": content}
+
+
+@app.get("/data")
+def get_data() -> DataOutput:
+    data = "hello".encode("utf-8")
+    return DataOutput(description="A plumbus", data=data)
+
+
+@app.post("/data-in-out")
+def post_data_in_out(body: DataInputOutput) -> DataInputOutput:
+    return body

docs_src/python_types/tutorial005_py39.py

@@ -1,2 +0,0 @@
-def get_items(item_a: str, item_b: int, item_c: float, item_d: bool, item_e: bytes):
-    return item_a, item_b, item_c, item_d, item_e

docs_src/stream_data/tutorial001_py310.py

@@ -0,0 +1,65 @@
+from collections.abc import AsyncIterable, Iterable
+
+from fastapi import FastAPI
+from fastapi.responses import StreamingResponse
+
+app = FastAPI()
+
+
+message = """
+Rick: (stumbles in drunkenly, and turns on the lights) Morty! You gotta come on. You got--... you gotta come with me.
+Morty: (rubs his eyes) What, Rick? What's going on?
+Rick: I got a surprise for you, Morty.
+Morty: It's the middle of the night. What are you talking about?
+Rick: (spills alcohol on Morty's bed) Come on, I got a surprise for you. (drags Morty by the ankle) Come on, hurry up. (pulls Morty out of his bed and into the hall)
+Morty: Ow! Ow! You're tugging me too hard!
+Rick: We gotta go, gotta get outta here, come on. Got a surprise for you Morty.
+"""
+
+
+@app.get("/story/stream", response_class=StreamingResponse)
+async def stream_story() -> AsyncIterable[str]:
+    for line in message.splitlines():
+        yield line
+
+
+@app.get("/story/stream-no-async", response_class=StreamingResponse)
+def stream_story_no_async() -> Iterable[str]:
+    for line in message.splitlines():
+        yield line
+
+
+@app.get("/story/stream-no-annotation", response_class=StreamingResponse)
+async def stream_story_no_annotation():
+    for line in message.splitlines():
+        yield line
+
+
+@app.get("/story/stream-no-async-no-annotation", response_class=StreamingResponse)
+def stream_story_no_async_no_annotation():
+    for line in message.splitlines():
+        yield line
+
+
+@app.get("/story/stream-bytes", response_class=StreamingResponse)
+async def stream_story_bytes() -> AsyncIterable[bytes]:
+    for line in message.splitlines():
+        yield line.encode("utf-8")
+
+
+@app.get("/story/stream-no-async-bytes", response_class=StreamingResponse)
+def stream_story_no_async_bytes() -> Iterable[bytes]:
+    for line in message.splitlines():
+        yield line.encode("utf-8")
+
+
+@app.get("/story/stream-no-annotation-bytes", response_class=StreamingResponse)
+async def stream_story_no_annotation_bytes():
+    for line in message.splitlines():
+        yield line.encode("utf-8")
+
+
+@app.get("/story/stream-no-async-no-annotation-bytes", response_class=StreamingResponse)
+def stream_story_no_async_no_annotation_bytes():
+    for line in message.splitlines():
+        yield line.encode("utf-8")

docs_src/stream_data/tutorial002_py310.py

@@ -0,0 +1,44 @@
+import base64
+from collections.abc import AsyncIterable, Iterable
+from io import BytesIO
+
+from fastapi import FastAPI
+from fastapi.responses import StreamingResponse
+
+image_base64 = "iVBORw0KGgoAAAANSUhEUgAAAB0AAAAdCAYAAABWk2cPAAAAbnpUWHRSYXcgcHJvZmlsZSB0eXBlIGV4aWYAAHjadYzRDYAwCET/mcIRDoq0jGOiJm7g+NJK0vjhS4DjIEfHfZ20DKqSrrWZmyFQV5ctRMOLACxglNCcXk7zVqFzJzF8kV6R5vOJ97yVH78HjfYAtg0ged033ZgAAAoCaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8P3hwYWNrZXQgYmVnaW49Iu+7vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/Pgo8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA0LjQuMC1FeGl2MiI+CiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4wLyIKICAgIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIgogICBleGlmOlBpeGVsWERpbWVuc2lvbj0iMjkiCiAgIGV4aWY6UGl4ZWxZRGltZW5zaW9uPSIyOSIKICAgdGlmZjpJbWFnZVdpZHRoPSIyOSIKICAgdGlmZjpJbWFnZUxlbmd0aD0iMjkiCiAgIHRpZmY6T3JpZW50YXRpb249IjEiLz4KIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAKPD94cGFja2V0IGVuZD0idyI/PnQkBZAAAAAEc0JJVAgICAh8CGSIAAABoklEQVRIx8VXwY7FIAjE5iXWU+P/f6RHPNW9LIaOoHYP+0yMShVkwNGG1lqjfy4HfaF0oyEEt+oSQqBaa//m9Wd6PlqhhbRMDiEQM3e59FNKw5qZHpnQfuPaW6lazsztvu/eElFj5j63lNLlMz2ttbZtVMu1MTGo5Sujn93gMzOllKiUQjHGB9QxxneZhJ5iwZ1rL2fwenoGeL0q3wVGhBPHMz0PeFccIfASEeWcO8xEROd50q6eAV6s1s5XXoncas1EKqVQznnwUBdJJmm1l3hmmdlOMrGO8Vl5gZ56Y0y8IZF0BuqkQWM4B6HXrRCKa1SEqyzEo7KK59RT/VHDjX3ZvSefeW3CO6O6vsiA1NrwVkxxAcYTCcHyTjZmJd00pugBQoTnzjvn+kzLBh9GtRDjhleZFwbx3kugP3GvFzdkqRlbDYw0u/HxKjuOw2QxZCGL5V5f4l7cd6qsffUa1DcLM9N1XcTMvep5ul1e4jNPtZfWGIkE6dI8MquXg/dS2CGVJQ2ushd5GmlxFdOw+1tRa32MY4zDQ9yaZ60J3/iX+QG4U3qGrFHmswAAAABJRU5ErkJggg=="
+binary_image = base64.b64decode(image_base64)
+
+
+def read_image() -> BytesIO:
+    return BytesIO(binary_image)
+
+
+app = FastAPI()
+
+
+class PNGStreamingResponse(StreamingResponse):
+    media_type = "image/png"
+
+
+@app.get("/image/stream", response_class=PNGStreamingResponse)
+async def stream_image() -> AsyncIterable[bytes]:
+    for chunk in read_image():
+        yield chunk
+
+
+@app.get("/image/stream-no-async", response_class=PNGStreamingResponse)
+def stream_image_no_async() -> Iterable[bytes]:
+    for chunk in read_image():
+        yield chunk
+
+
+@app.get("/image/stream-no-annotation", response_class=PNGStreamingResponse)
+async def stream_image_no_annotation():
+    for chunk in read_image():
+        yield chunk
+
+
+@app.get("/image/stream-no-async-no-annotation", response_class=PNGStreamingResponse)
+def stream_image_no_async_no_annotation():
+    for chunk in read_image():
+        yield chunk

docs_src/stream_json_lines/tutorial001_py310.py

@@ -0,0 +1,42 @@
+from collections.abc import AsyncIterable, Iterable
+
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class Item(BaseModel):
+    name: str
+    description: str | None
+
+
+items = [
+    Item(name="Plumbus", description="A multi-purpose household device."),
+    Item(name="Portal Gun", description="A portal opening device."),
+    Item(name="Meeseeks Box", description="A box that summons a Meeseeks."),
+]
+
+
+@app.get("/items/stream")
+async def stream_items() -> AsyncIterable[Item]:
+    for item in items:
+        yield item
+
+
+@app.get("/items/stream-no-async")
+def stream_items_no_async() -> Iterable[Item]:
+    for item in items:
+        yield item
+
+
+@app.get("/items/stream-no-annotation")
+async def stream_items_no_annotation():
+    for item in items:
+        yield item
+
+
+@app.get("/items/stream-no-async-no-annotation")
+def stream_items_no_async_no_annotation():
+    for item in items:
+        yield item

docs_src/strict_content_type/tutorial001_py310.py

@@ -0,0 +1,14 @@
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI(strict_content_type=False)
+
+
+class Item(BaseModel):
+    name: str
+    price: float
+
+
+@app.post("/items/")
+async def create_item(item: Item):
+    return item

fastapi/.agents/skills/fastapi/SKILL.md

@@ -0,0 +1,614 @@
+---
+name: fastapi
+description: FastAPI best practices and conventions. Use when working with FastAPI APIs and Pydantic models for them. Keeps FastAPI code clean and up to date with the latest features and patterns, updated with new versions. Write new code or refactor and update old code.
+---
+
+# FastAPI
+
+Official FastAPI skill to write code with best practices, keeping up to date with new versions and features.
+
+## Use the `fastapi` CLI
+
+Run the development server on localhost with reload:
+
+```bash
+fastapi dev
+```
+
+
+Run the production server:
+
+```bash
+fastapi run
+```
+
+### Add an entrypoint in `pyproject.toml`
+
+FastAPI CLI will read the entrypoint in `pyproject.toml` to know where the FastAPI app is declared.
+
+```toml
+[tool.fastapi]
+entrypoint = "my_app.main:app"
+```
+
+### Use `fastapi` with a path
+
+When adding the entrypoint to `pyproject.toml` is not possible, or the user explicitly asks not to, or it's running an independent small app, you can pass the app file path to the `fastapi` command:
+
+```bash
+fastapi dev my_app/main.py
+```
+
+Prefer to set the entrypoint in `pyproject.toml` when possible.
+
+## Use `Annotated`
+
+Always prefer the `Annotated` style for parameter and dependency declarations.
+
+It keeps the function signatures working in other contexts, respects the types, allows reusability.
+
+### In Parameter Declarations
+
+Use `Annotated` for parameter declarations, including `Path`, `Query`, `Header`, etc.:
+
+```python
+from typing import Annotated
+
+from fastapi import FastAPI, Path, Query
+
+app = FastAPI()
+
+
+@app.get("/items/{item_id}")
+async def read_item(
+    item_id: Annotated[int, Path(ge=1, description="The item ID")],
+    q: Annotated[str | None, Query(max_length=50)] = None,
+):
+    return {"message": "Hello World"}
+```
+
+instead of:
+
+```python
+# DO NOT DO THIS
+@app.get("/items/{item_id}")
+async def read_item(
+    item_id: int = Path(ge=1, description="The item ID"),
+    q: str | None = Query(default=None, max_length=50),
+):
+    return {"message": "Hello World"}
+```
+
+### For Dependencies
+
+Use `Annotated` for dependencies with `Depends()`.
+
+Unless asked not to, create a new type alias for the dependency to allow re-using it.
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+
+app = FastAPI()
+
+
+def get_current_user():
+    return {"username": "johndoe"}
+
+
+CurrentUserDep = Annotated[dict, Depends(get_current_user)]
+
+
+@app.get("/items/")
+async def read_item(current_user: CurrentUserDep):
+    return {"message": "Hello World"}
+```
+
+instead of:
+
+```python
+# DO NOT DO THIS
+@app.get("/items/")
+async def read_item(current_user: dict = Depends(get_current_user)):
+    return {"message": "Hello World"}
+```
+
+## Do not use Ellipsis for *path operations* or Pydantic models
+
+Do not use `...` as a default value for required parameters, it's not needed and not recommended.
+
+Do this, without Ellipsis (`...`):
+
+```python
+from typing import Annotated
+
+from fastapi import FastAPI, Query
+from pydantic import BaseModel, Field
+
+
+class Item(BaseModel):
+    name: str
+    description: str | None = None
+    price: float = Field(gt=0)
+
+
+app = FastAPI()
+
+
+@app.post("/items/")
+async def create_item(item: Item, project_id: Annotated[int, Query()]): ...
+```
+
+instead of this:
+
+```python
+# DO NOT DO THIS
+class Item(BaseModel):
+    name: str = ...
+    description: str | None = None
+    price: float = Field(..., gt=0)
+
+
+app = FastAPI()
+
+
+@app.post("/items/")
+async def create_item(item: Item, project_id: Annotated[int, Query(...)]): ...
+```
+
+## Return Type or Response Model
+
+When possible, include a return type. It will be used to validate, filter, document, and serialize the response.
+
+```python
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class Item(BaseModel):
+    name: str
+    description: str | None = None
+
+
+@app.get("/items/me")
+async def get_item() -> Item:
+    return Item(name="Plumbus", description="All-purpose home device")
+```
+
+**Important**: Return types or response models are what filter data ensuring no sensitive information is exposed. And they are used to serialize data with Pydantic (in Rust), this is the main idea that can increase response performance.
+
+The return type doesn't have to be a Pydantic model, it could be a different type, like a list of integers, or a dict, etc.
+
+### When to use `response_model` instead
+
+If the return type is not the same as the type that you want to use to validate, filter, or serialize, use the `response_model` parameter on the decorator instead.
+
+```python
+from typing import Any
+
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class Item(BaseModel):
+    name: str
+    description: str | None = None
+
+
+@app.get("/items/me", response_model=Item)
+async def get_item() -> Any:
+    return {"name": "Foo", "description": "A very nice Item"}
+```
+
+This can be particularly useful when filtering data to expose only the public fields and avoid exposing sensitive information.
+
+```python
+from typing import Any
+
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class InternalItem(BaseModel):
+    name: str
+    description: str | None = None
+    secret_key: str
+
+
+class Item(BaseModel):
+    name: str
+    description: str | None = None
+
+
+@app.get("/items/me", response_model=Item)
+async def get_item() -> Any:
+    item = InternalItem(
+        name="Foo", description="A very nice Item", secret_key="supersecret"
+    )
+    return item
+```
+
+## Performance
+
+Do not use `ORJSONResponse` or `UJSONResponse`, they are deprecated.
+
+Instead, declare a return type or response model. Pydantic will handle the data serialization on the Rust side.
+
+## Including Routers
+
+When declaring routers, prefer to add router level parameters like prefix, tags, etc. to the router itself, instead of in `include_router()`.
+
+Do this:
+
+```python
+from fastapi import APIRouter, FastAPI
+
+app = FastAPI()
+
+router = APIRouter(prefix="/items", tags=["items"])
+
+
+@router.get("/")
+async def list_items():
+    return []
+
+
+# In main.py
+app.include_router(router)
+```
+
+instead of this:
+
+```python
+# DO NOT DO THIS
+from fastapi import APIRouter, FastAPI
+
+app = FastAPI()
+
+router = APIRouter()
+
+
+@router.get("/")
+async def list_items():
+    return []
+
+
+# In main.py
+app.include_router(router, prefix="/items", tags=["items"])
+```
+
+There could be exceptions, but try to follow this convention.
+
+Apply shared dependencies at the router level via `dependencies=[Depends(...)]`.
+
+## Dependency Injection
+
+Use dependencies when:
+
+* They can't be declared in Pydantic validation and require additional logic
+* The logic depends on external resources or could block in any other way
+* Other dependencies need their results (it's a sub-dependency)
+* The logic can be shared by multiple endpoints to do things like error early, authentication, etc.
+* They need to handle cleanup (e.g., DB sessions, file handles), using dependencies with `yield`
+* Their logic needs input data from the request, like headers, query parameters, etc.
+
+### Dependencies with `yield` and `scope`
+
+When using dependencies with `yield`, they can have a `scope` that defines when the exit code is run.
+
+Use the default scope `"request"` to run the exit code after the response is sent back.
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+
+app = FastAPI()
+
+
+def get_db():
+    db = DBSession()
+    try:
+        yield db
+    finally:
+        db.close()
+
+
+DBDep = Annotated[DBSession, Depends(get_db)]
+
+
+@app.get("/items/")
+async def read_items(db: DBDep):
+    return db.query(Item).all()
+```
+
+Use the scope `"function"` when they should run the exit code after the response data is generated but before the response is sent back to the client.
+
+```python
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+
+app = FastAPI()
+
+
+def get_username():
+    try:
+        yield "Rick"
+    finally:
+        print("Cleanup up before response is sent")
+
+UserNameDep = Annotated[str, Depends(get_username, scope="function")]
+
+@app.get("/users/me")
+def get_user_me(username: UserNameDep):
+    return username
+```
+
+### Class Dependencies
+
+Avoid creating class dependencies when possible.
+
+If a class is needed, instead create a regular function dependency that returns a class instance.
+
+Do this:
+
+```python
+from dataclasses import dataclass
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+
+app = FastAPI()
+
+
+@dataclass
+class DatabasePaginator:
+    offset: int = 0
+    limit: int = 100
+    q: str | None = None
+
+    def get_page(self) -> dict:
+        # Simulate a page of data
+        return {
+            "offset": self.offset,
+            "limit": self.limit,
+            "q": self.q,
+            "items": [],
+        }
+
+
+def get_db_paginator(
+    offset: int = 0, limit: int = 100, q: str | None = None
+) -> DatabasePaginator:
+    return DatabasePaginator(offset=offset, limit=limit, q=q)
+
+
+PaginatorDep = Annotated[DatabasePaginator, Depends(get_db_paginator)]
+
+
+@app.get("/items/")
+async def read_items(paginator: PaginatorDep):
+    return paginator.get_page()
+```
+
+instead of this:
+
+```python
+# DO NOT DO THIS
+from typing import Annotated
+
+from fastapi import Depends, FastAPI
+
+app = FastAPI()
+
+
+class DatabasePaginator:
+    def __init__(self, offset: int = 0, limit: int = 100, q: str | None = None):
+        self.offset = offset
+        self.limit = limit
+        self.q = q
+
+    def get_page(self) -> dict:
+        # Simulate a page of data
+        return {
+            "offset": self.offset,
+            "limit": self.limit,
+            "q": self.q,
+            "items": [],
+        }
+
+
+@app.get("/items/")
+async def read_items(paginator: Annotated[DatabasePaginator, Depends()]):
+    return paginator.get_page()
+```
+
+## Async vs Sync *path operations*
+
+Use `async` *path operations* only when fully certain that the logic called inside is compatible with async and await (it's called with `await`) or that doesn't block.
+
+```python
+from fastapi import FastAPI
+
+app = FastAPI()
+
+
+# Use async def when calling async code
+@app.get("/async-items/")
+async def read_async_items():
+    data = await some_async_library.fetch_items()
+    return data
+
+
+# Use plain def when calling blocking/sync code or when in doubt
+@app.get("/items/")
+def read_items():
+    data = some_blocking_library.fetch_items()
+    return data
+```
+
+In case of doubt, or by default, use regular `def` functions, those will be run in a threadpool so they don't block the event loop.
+
+The same rules apply to dependencies.
+
+Make sure blocking code is not run inside of `async` functions. The logic will work, but will damage the performance heavily.
+
+### Asyncer
+
+When needing to run blocking code inside of async functions, or async code inside of blocking functions, suggest using Asyncer.
+
+Install:
+
+```bash
+uv add asyncer
+```
+
+Run blocking sync code inside of async with `asyncify()`:
+
+```python
+from asyncer import asyncify
+from fastapi import FastAPI
+
+app = FastAPI()
+
+
+def do_blocking_work(name: str) -> str:
+    # Some blocking I/O operation
+    return f"Hello {name}"
+
+
+@app.get("/items/")
+async def read_items():
+    result = await asyncify(do_blocking_work)(name="World")
+    return {"message": result}
+```
+
+And run async code inside of blocking sync code with `syncify()`:
+
+```python
+from asyncer import syncify
+from fastapi import FastAPI
+
+app = FastAPI()
+
+
+async def do_async_work(name: str) -> str:
+    return f"Hello {name}"
+
+
+@app.get("/items/")
+def read_items():
+    result = syncify(do_async_work)(name="World")
+    return {"message": result}
+```
+
+## Use uv, ruff, ty
+
+If uv is available, use it to manage dependencies.
+
+If Ruff is available, use it to lint and format the code. Consider enabling the FastAPI rules.
+
+If ty is available, use it to check types.
+
+## SQLModel for SQL databases
+
+When working with SQL databases, prefer using SQLModel as it is integrated with Pydantic and will allow declaring data validation with the same models.
+
+## Do not use Pydantic RootModels
+
+Do not use Pydantic `RootModel`, instead use regular type annotations with `Annotated` and Pydantic validation utilities.
+
+For example, for a list with validations you could do:
+
+```python
+from typing import Annotated
+
+from fastapi import Body, FastAPI
+from pydantic import Field
+
+app = FastAPI()
+
+
+@app.post("/items/")
+async def create_items(items: Annotated[list[int], Field(min_length=1), Body()]):
+    return items
+```
+
+instead of:
+
+```python
+# DO NOT DO THIS
+from typing import Annotated
+
+from fastapi import FastAPI
+from pydantic import Field, RootModel
+
+app = FastAPI()
+
+
+class ItemList(RootModel[Annotated[list[int], Field(min_length=1)]]):
+    pass
+
+
+@app.post("/items/")
+async def create_items(items: ItemList):
+    return items
+
+```
+
+FastAPI supports these type annotations and will create a Pydantic `TypeAdapter` for them, so that types can work as normally and there's no need for the custom logic and types in RootModels.
+
+## Use one HTTP operation per function
+
+Don't mix HTTP operations in a single function, having one function per HTTP operation helps separate concerns and organize the code.
+
+Do this:
+
+```python
+from fastapi import FastAPI
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class Item(BaseModel):
+    name: str
+
+
+@app.get("/items/")
+async def list_items():
+    return []
+
+
+@app.post("/items/")
+async def create_item(item: Item):
+    return item
+```
+
+instead of this:
+
+```python
+# DO NOT DO THIS
+from fastapi import FastAPI, Request
+from pydantic import BaseModel
+
+app = FastAPI()
+
+
+class Item(BaseModel):
+    name: str
+
+
+@app.api_route("/items/", methods=["GET", "POST"])
+async def handle_items(request: Request):
+    if request.method == "GET":
+        return []
+```

fastapi/__init__.py

@@ -1,6 +1,6 @@
 """FastAPI framework, high performance, easy to learn, fast to code, ready for production"""
 
-__version__ = "0.129.0"
+__version__ = "0.133.1"
 
 from starlette import status as status
 

fastapi/_compat/v2.py

@@ -27,7 +27,7 @@ from pydantic._internal._schema_generation_shared import (  # type: ignore[attr-
 )
 from pydantic._internal._typing_extra import eval_type_lenient
 from pydantic.fields import FieldInfo as FieldInfo
-from pydantic.json_schema import GenerateJsonSchema as GenerateJsonSchema
+from pydantic.json_schema import GenerateJsonSchema as _GenerateJsonSchema
 from pydantic.json_schema import JsonSchemaValue as JsonSchemaValue
 from pydantic_core import CoreSchema as CoreSchema
 from pydantic_core import PydanticUndefined
@@ -40,6 +40,23 @@ RequiredParam = PydanticUndefined
 Undefined = PydanticUndefined
 evaluate_forwardref = eval_type_lenient
 
+
+class GenerateJsonSchema(_GenerateJsonSchema):
+    # TODO: remove when this is merged (or equivalent): https://github.com/pydantic/pydantic/pull/12841
+    # and dropping support for any version of Pydantic before that one (so, in a very long time)
+    def bytes_schema(self, schema: CoreSchema) -> JsonSchemaValue:
+        json_schema = {"type": "string", "contentMediaType": "application/octet-stream"}
+        bytes_mode = (
+            self._config.ser_json_bytes
+            if self.mode == "serialization"
+            else self._config.val_json_bytes
+        )
+        if bytes_mode == "base64":
+            json_schema["contentEncoding"] = "base64"
+        self.update_with_validations(json_schema, schema, self.ValidationsMapping.bytes)
+        return json_schema
+
+
 # TODO: remove when dropping support for Pydantic < v2.12.3
 _Attrs = {
     "default": ...,
@@ -182,6 +199,32 @@ class ModelField:
             exclude_none=exclude_none,
         )
 
+    def serialize_json(
+        self,
+        value: Any,
+        *,
+        include: IncEx | None = None,
+        exclude: IncEx | None = None,
+        by_alias: bool = True,
+        exclude_unset: bool = False,
+        exclude_defaults: bool = False,
+        exclude_none: bool = False,
+    ) -> bytes:
+        # What calls this code passes a value that already called
+        # self._type_adapter.validate_python(value)
+        # This uses Pydantic's dump_json() which serializes directly to JSON
+        # bytes in one pass (via Rust), avoiding the intermediate Python dict
+        # step of dump_python(mode="json") + json.dumps().
+        return self._type_adapter.dump_json(
+            value,
+            include=include,
+            exclude=exclude,
+            by_alias=by_alias,
+            exclude_unset=exclude_unset,
+            exclude_defaults=exclude_defaults,
+            exclude_none=exclude_none,
+        )
+
     def __hash__(self) -> int:
         # Each ModelField is unique for our purposes, to allow making a dict from
         # ModelField to its JSON Schema.

fastapi/applications.py

@@ -840,6 +840,29 @@ class FastAPI(Starlette):
                 """
             ),
         ] = None,
+        strict_content_type: Annotated[
+            bool,
+            Doc(
+                """
+                Enable strict checking for request Content-Type headers.
+
+                When `True` (the default), requests with a body that do not include
+                a `Content-Type` header will **not** be parsed as JSON.
+
+                This prevents potential cross-site request forgery (CSRF) attacks
+                that exploit the browser's ability to send requests without a
+                Content-Type header, bypassing CORS preflight checks. In particular
+                applicable for apps that need to be run locally (in localhost).
+
+                When `False`, requests without a `Content-Type` header will have
+                their body parsed as JSON, which maintains compatibility with
+                certain clients that don't send `Content-Type` headers.
+
+                Read more about it in the
+                [FastAPI docs for Strict Content-Type](https://fastapi.tiangolo.com/advanced/strict-content-type/).
+                """
+            ),
+        ] = True,
         **extra: Annotated[
             Any,
             Doc(
@@ -974,6 +997,7 @@ class FastAPI(Starlette):
             include_in_schema=include_in_schema,
             responses=responses,
             generate_unique_id_function=generate_unique_id_function,
+            strict_content_type=strict_content_type,
         )
         self.exception_handlers: dict[
             Any, Callable[[Request, Any], Response | Awaitable[Response]]
@@ -1077,16 +1101,18 @@ class FastAPI(Starlette):
 
     def setup(self) -> None:
         if self.openapi_url:
-            urls = (server_data.get("url") for server_data in self.servers)
-            server_urls = {url for url in urls if url}
 
             async def openapi(req: Request) -> JSONResponse:
                 root_path = req.scope.get("root_path", "").rstrip("/")
-                if root_path not in server_urls:
+                schema = self.openapi()
-                    if root_path and self.root_path_in_servers:
+                if root_path and self.root_path_in_servers:
-                        self.servers.insert(0, {"url": root_path})
+                    server_urls = {s.get("url") for s in schema.get("servers", [])}
-                        server_urls.add(root_path)
+                    if root_path not in server_urls:
-                return JSONResponse(self.openapi())
+                        schema = dict(schema)
+                        schema["servers"] = [{"url": root_path}] + schema.get(
+                            "servers", []
+                        )
+                return JSONResponse(schema)
 
             self.add_route(self.openapi_url, openapi, include_in_schema=False)
         if self.openapi_url and self.docs_url:

fastapi/datastructures.py

@@ -139,7 +139,7 @@ class UploadFile(StarletteUploadFile):
     def __get_pydantic_json_schema__(
         cls, core_schema: Mapping[str, Any], handler: GetJsonSchemaHandler
     ) -> dict[str, Any]:
-        return {"type": "string", "format": "binary"}
+        return {"type": "string", "contentMediaType": "application/octet-stream"}
 
     @classmethod
     def __get_pydantic_core_schema__(

fastapi/dependencies/utils.py

@@ -1,7 +1,17 @@
 import dataclasses
 import inspect
 import sys
-from collections.abc import Callable, Mapping, Sequence
+from collections.abc import (
+    AsyncGenerator,
+    AsyncIterable,
+    AsyncIterator,
+    Callable,
+    Generator,
+    Iterable,
+    Iterator,
+    Mapping,
+    Sequence,
+)
 from contextlib import AsyncExitStack, contextmanager
 from copy import copy, deepcopy
 from dataclasses import dataclass
@@ -251,6 +261,26 @@ def get_typed_return_annotation(call: Callable[..., Any]) -> Any:
     return get_typed_annotation(annotation, globalns)
 
 
+_STREAM_ORIGINS = {
+    AsyncIterable,
+    AsyncIterator,
+    AsyncGenerator,
+    Iterable,
+    Iterator,
+    Generator,
+}
+
+
+def get_stream_item_type(annotation: Any) -> Any | None:
+    origin = get_origin(annotation)
+    if origin is not None and origin in _STREAM_ORIGINS:
+        type_args = get_args(annotation)
+        if type_args:
+            return type_args[0]
+        return Any
+    return None
+
+
 def get_dependant(
     *,
     path: str,

fastapi/openapi/docs.py

@@ -5,6 +5,20 @@ from annotated_doc import Doc
 from fastapi.encoders import jsonable_encoder
 from starlette.responses import HTMLResponse
 
+
+def _html_safe_json(value: Any) -> str:
+    """Serialize a value to JSON with HTML special characters escaped.
+
+    This prevents injection when the JSON is embedded inside a <script> tag.
+    """
+    return (
+        json.dumps(value)
+        .replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+        .replace("&", "\\u0026")
+    )
+
+
 swagger_ui_default_parameters: Annotated[
     dict[str, Any],
     Doc(
@@ -155,7 +169,7 @@ def get_swagger_ui_html(
     """
 
     for key, value in current_swagger_ui_parameters.items():
-        html += f"{json.dumps(key)}: {json.dumps(jsonable_encoder(value))},\n"
+        html += f"{_html_safe_json(key)}: {_html_safe_json(jsonable_encoder(value))},\n"
 
     if oauth2_redirect_url:
         html += f"oauth2RedirectUrl: window.location.origin + '{oauth2_redirect_url}',"
@@ -169,7 +183,7 @@ def get_swagger_ui_html(
 
     if init_oauth:
         html += f"""
-        ui.initOAuth({json.dumps(jsonable_encoder(init_oauth))})
+        ui.initOAuth({_html_safe_json(jsonable_encoder(init_oauth))})
         """
 
     html += """

fastapi/openapi/utils.py

@@ -355,25 +355,40 @@ def get_openapi_path(
             operation.setdefault("responses", {}).setdefault(status_code, {})[
                 "description"
             ] = route.response_description
-            if route_response_media_type and is_body_allowed_for_status_code(
+            if is_body_allowed_for_status_code(route.status_code):
-                route.status_code
+                # Check for JSONL streaming (generator endpoints)
-            ):
+                if route.is_json_stream:
-                response_schema = {"type": "string"}
+                    jsonl_content: dict[str, Any] = {}
-                if lenient_issubclass(current_response_class, JSONResponse):
+                    if route.stream_item_field:
-                    if route.response_field:
+                        item_schema = get_schema_from_model_field(
-                        response_schema = get_schema_from_model_field(
+                            field=route.stream_item_field,
-                            field=route.response_field,
                             model_name_map=model_name_map,
                             field_mapping=field_mapping,
                             separate_input_output_schemas=separate_input_output_schemas,
                         )
+                        jsonl_content["itemSchema"] = item_schema
                     else:
-                        response_schema = {}
+                        jsonl_content["itemSchema"] = {}
-                operation.setdefault("responses", {}).setdefault(
+                    operation.setdefault("responses", {}).setdefault(
-                    status_code, {}
+                        status_code, {}
-                ).setdefault("content", {}).setdefault(route_response_media_type, {})[
+                    ).setdefault("content", {})["application/jsonl"] = jsonl_content
-                    "schema"
+                elif route_response_media_type:
-                ] = response_schema
+                    response_schema = {"type": "string"}
+                    if lenient_issubclass(current_response_class, JSONResponse):
+                        if route.response_field:
+                            response_schema = get_schema_from_model_field(
+                                field=route.response_field,
+                                model_name_map=model_name_map,
+                                field_mapping=field_mapping,
+                                separate_input_output_schemas=separate_input_output_schemas,
+                            )
+                        else:
+                            response_schema = {}
+                    operation.setdefault("responses", {}).setdefault(
+                        status_code, {}
+                    ).setdefault("content", {}).setdefault(
+                        route_response_media_type, {}
+                    )["schema"] = response_schema
             if route.responses:
                 operation_responses = operation.setdefault("responses", {})
                 for (
@@ -453,9 +468,9 @@ def get_fields_from_routes(
     request_fields_from_routes: list[ModelField] = []
     callback_flat_models: list[ModelField] = []
     for route in routes:
-        if getattr(route, "include_in_schema", None) and isinstance(
+        if not isinstance(route, routing.APIRoute):
-            route, routing.APIRoute
+            continue
-        ):
+        if route.include_in_schema:
             if route.body_field:
                 assert isinstance(route.body_field, ModelField), (
                     "A request body must be a Pydantic Field"
@@ -465,6 +480,8 @@ def get_fields_from_routes(
                 responses_from_routes.append(route.response_field)
             if route.response_fields:
                 responses_from_routes.extend(route.response_fields.values())
+            if route.stream_item_field:
+                responses_from_routes.append(route.stream_item_field)
             if route.callbacks:
                 callback_flat_models.extend(get_fields_from_routes(route.callbacks))
             params = get_flat_params(route.dependant)

fastapi/responses.py

@@ -1,5 +1,6 @@
 from typing import Any
 
+from fastapi.exceptions import FastAPIDeprecationWarning
 from starlette.responses import FileResponse as FileResponse  # noqa
 from starlette.responses import HTMLResponse as HTMLResponse  # noqa
 from starlette.responses import JSONResponse as JSONResponse  # noqa
@@ -7,6 +8,7 @@ from starlette.responses import PlainTextResponse as PlainTextResponse  # noqa
 from starlette.responses import RedirectResponse as RedirectResponse  # noqa
 from starlette.responses import Response as Response  # noqa
 from starlette.responses import StreamingResponse as StreamingResponse  # noqa
+from typing_extensions import deprecated
 
 try:
     import ujson
@@ -20,12 +22,29 @@ except ImportError:  # pragma: nocover
     orjson = None  # type: ignore
 
 
+@deprecated(
+    "UJSONResponse is deprecated, FastAPI now serializes data directly to JSON "
+    "bytes via Pydantic when a return type or response model is set, which is "
+    "faster and doesn't need a custom response class. Read more in the FastAPI "
+    "docs: https://fastapi.tiangolo.com/advanced/custom-response/#orjson-or-response-model "
+    "and https://fastapi.tiangolo.com/tutorial/response-model/",
+    category=FastAPIDeprecationWarning,
+    stacklevel=2,
+)
 class UJSONResponse(JSONResponse):
-    """
+    """JSON response using the ujson library to serialize data to JSON.
-    JSON response using the high-performance ujson library to serialize data to JSON.
 
-    Read more about it in the
+    **Deprecated**: `UJSONResponse` is deprecated. FastAPI now serializes data
-    [FastAPI docs for Custom Response - HTML, Stream, File, others](https://fastapi.tiangolo.com/advanced/custom-response/).
+    directly to JSON bytes via Pydantic when a return type or response model is
+    set, which is faster and doesn't need a custom response class.
+
+    Read more in the
+    [FastAPI docs for Custom Response](https://fastapi.tiangolo.com/advanced/custom-response/#orjson-or-response-model)
+    and the
+    [FastAPI docs for Response Model](https://fastapi.tiangolo.com/tutorial/response-model/).
+
+    **Note**: `ujson` is not included with FastAPI and must be installed
+    separately, e.g. `pip install ujson`.
     """
 
     def render(self, content: Any) -> bytes:
@@ -33,12 +52,29 @@ class UJSONResponse(JSONResponse):
         return ujson.dumps(content, ensure_ascii=False).encode("utf-8")
 
 
+@deprecated(
+    "ORJSONResponse is deprecated, FastAPI now serializes data directly to JSON "
+    "bytes via Pydantic when a return type or response model is set, which is "
+    "faster and doesn't need a custom response class. Read more in the FastAPI "
+    "docs: https://fastapi.tiangolo.com/advanced/custom-response/#orjson-or-response-model "
+    "and https://fastapi.tiangolo.com/tutorial/response-model/",
+    category=FastAPIDeprecationWarning,
+    stacklevel=2,
+)
 class ORJSONResponse(JSONResponse):
-    """
+    """JSON response using the orjson library to serialize data to JSON.
-    JSON response using the high-performance orjson library to serialize data to JSON.
 
-    Read more about it in the
+    **Deprecated**: `ORJSONResponse` is deprecated. FastAPI now serializes data
-    [FastAPI docs for Custom Response - HTML, Stream, File, others](https://fastapi.tiangolo.com/advanced/custom-response/).
+    directly to JSON bytes via Pydantic when a return type or response model is
+    set, which is faster and doesn't need a custom response class.
+
+    Read more in the
+    [FastAPI docs for Custom Response](https://fastapi.tiangolo.com/advanced/custom-response/#orjson-or-response-model)
+    and the
+    [FastAPI docs for Response Model](https://fastapi.tiangolo.com/tutorial/response-model/).
+
+    **Note**: `orjson` is not included with FastAPI and must be installed
+    separately, e.g. `pip install orjson`.
     """
 
     def render(self, content: Any) -> bytes:

fastapi/routing.py

@@ -11,6 +11,7 @@ from collections.abc import (
     Collection,
     Coroutine,
     Generator,
+    Iterator,
     Mapping,
     Sequence,
 )
@@ -27,6 +28,7 @@ from typing import (
     TypeVar,
 )
 
+import anyio
 from annotated_doc import Doc
 from fastapi import params
 from fastapi._compat import (
@@ -42,6 +44,7 @@ from fastapi.dependencies.utils import (
     get_dependant,
     get_flat_dependant,
     get_parameterless_sub_dependant,
+    get_stream_item_type,
     get_typed_return_annotation,
     solve_dependencies,
 )
@@ -66,7 +69,7 @@ from starlette._utils import is_async_callable
 from starlette.concurrency import run_in_threadpool
 from starlette.exceptions import HTTPException
 from starlette.requests import Request
-from starlette.responses import JSONResponse, Response
+from starlette.responses import JSONResponse, Response, StreamingResponse
 from starlette.routing import (
     BaseRoute,
     Match,
@@ -271,6 +274,7 @@ async def serialize_response(
     exclude_none: bool = False,
     is_coroutine: bool = True,
     endpoint_ctx: EndpointContext | None = None,
+    dump_json: bool = False,
 ) -> Any:
     if field:
         if is_coroutine:
@@ -286,8 +290,8 @@ async def serialize_response(
                 body=response_content,
                 endpoint_ctx=ctx,
             )
-
+        serializer = field.serialize_json if dump_json else field.serialize
-        return field.serialize(
+        return serializer(
             value,
             include=include,
             exclude=exclude,
@@ -314,6 +318,24 @@ async def run_endpoint_function(
         return await run_in_threadpool(dependant.call, **values)
 
 
+def _build_response_args(
+    *, status_code: int | None, solved_result: Any
+) -> dict[str, Any]:
+    response_args: dict[str, Any] = {
+        "background": solved_result.background_tasks,
+    }
+    # If status_code was set, use it, otherwise use the default from the
+    # response class, in the case of redirect it's 307
+    current_status_code = (
+        status_code if status_code else solved_result.response.status_code
+    )
+    if current_status_code is not None:
+        response_args["status_code"] = current_status_code
+    if solved_result.response.status_code:
+        response_args["status_code"] = solved_result.response.status_code
+    return response_args
+
+
 def get_request_handler(
     dependant: Dependant,
     body_field: ModelField | None = None,
@@ -328,6 +350,9 @@ def get_request_handler(
     response_model_exclude_none: bool = False,
     dependency_overrides_provider: Any | None = None,
     embed_body_fields: bool = False,
+    strict_content_type: bool | DefaultPlaceholder = Default(True),
+    stream_item_field: ModelField | None = None,
+    is_json_stream: bool = False,
 ) -> Callable[[Request], Coroutine[Any, Any, Response]]:
     assert dependant.call is not None, "dependant.call must be a function"
     is_coroutine = dependant.is_coroutine_callable
@@ -336,6 +361,10 @@ def get_request_handler(
         actual_response_class: type[Response] = response_class.value
     else:
         actual_response_class = response_class
+    if isinstance(strict_content_type, DefaultPlaceholder):
+        actual_strict_content_type: bool = strict_content_type.value
+    else:
+        actual_strict_content_type = strict_content_type
 
     async def app(request: Request) -> Response:
         response: Response | None = None
@@ -369,7 +398,8 @@ def get_request_handler(
                         json_body: Any = Undefined
                         content_type_value = request.headers.get("content-type")
                         if not content_type_value:
-                            json_body = await request.json()
+                            if not actual_strict_content_type:
+                                json_body = await request.json()
                         else:
                             message = email.message.Message()
                             message["content-type"] = content_type_value
@@ -420,45 +450,130 @@ def get_request_handler(
             embed_body_fields=embed_body_fields,
         )
         errors = solved_result.errors
+        assert dependant.call  # For types
         if not errors:
-            raw_response = await run_endpoint_function(
+            if is_json_stream:
-                dependant=dependant,
+                # Generator endpoint: stream as JSONL
-                values=solved_result.values,
+                gen = dependant.call(**solved_result.values)
-                is_coroutine=is_coroutine,
+
-            )
+                def _serialize_item(item: Any) -> bytes:
-            if isinstance(raw_response, Response):
+                    if stream_item_field:
-                if raw_response.background is None:
+                        value, errors = stream_item_field.validate(
-                    raw_response.background = solved_result.background_tasks
+                            item, {}, loc=("response",)
-                response = raw_response
+                        )
-            else:
+                        if errors:
-                response_args: dict[str, Any] = {
+                            ctx = endpoint_ctx or EndpointContext()
-                    "background": solved_result.background_tasks
+                            raise ResponseValidationError(
-                }
+                                errors=errors,
-                # If status_code was set, use it, otherwise use the default from the
+                                body=item,
-                # response class, in the case of redirect it's 307
+                                endpoint_ctx=ctx,
-                current_status_code = (
+                            )
-                    status_code if status_code else solved_result.response.status_code
+                        line = stream_item_field.serialize_json(
+                            value,
+                            include=response_model_include,
+                            exclude=response_model_exclude,
+                            by_alias=response_model_by_alias,
+                            exclude_unset=response_model_exclude_unset,
+                            exclude_defaults=response_model_exclude_defaults,
+                            exclude_none=response_model_exclude_none,
+                        )
+                        return line + b"\n"
+                    else:
+                        data = jsonable_encoder(item)
+                        return json.dumps(data).encode("utf-8") + b"\n"
+
+                if dependant.is_async_gen_callable:
+
+                    async def _async_stream_jsonl() -> AsyncIterator[bytes]:
+                        async for item in gen:
+                            yield _serialize_item(item)
+                            # To allow for cancellation to trigger
+                            # Ref: https://github.com/fastapi/fastapi/issues/14680
+                            await anyio.sleep(0)
+
+                    stream_content: AsyncIterator[bytes] | Iterator[bytes] = (
+                        _async_stream_jsonl()
+                    )
+                else:
+
+                    def _sync_stream_jsonl() -> Iterator[bytes]:
+                        for item in gen:
+                            yield _serialize_item(item)
+
+                    stream_content = _sync_stream_jsonl()
+
+                response = StreamingResponse(
+                    stream_content,
+                    media_type="application/jsonl",
+                    background=solved_result.background_tasks,
                 )
-                if current_status_code is not None:
-                    response_args["status_code"] = current_status_code
-                if solved_result.response.status_code:
-                    response_args["status_code"] = solved_result.response.status_code
-                content = await serialize_response(
-                    field=response_field,
-                    response_content=raw_response,
-                    include=response_model_include,
-                    exclude=response_model_exclude,
-                    by_alias=response_model_by_alias,
-                    exclude_unset=response_model_exclude_unset,
-                    exclude_defaults=response_model_exclude_defaults,
-                    exclude_none=response_model_exclude_none,
-                    is_coroutine=is_coroutine,
-                    endpoint_ctx=endpoint_ctx,
-                )
-                response = actual_response_class(content, **response_args)
-                if not is_body_allowed_for_status_code(response.status_code):
-                    response.body = b""
                 response.headers.raw.extend(solved_result.response.headers.raw)
+            elif dependant.is_async_gen_callable or dependant.is_gen_callable:
+                # Raw streaming with explicit response_class (e.g. StreamingResponse)
+                gen = dependant.call(**solved_result.values)
+                if dependant.is_async_gen_callable:
+
+                    async def _async_stream_raw(
+                        async_gen: AsyncIterator[Any],
+                    ) -> AsyncIterator[Any]:
+                        async for chunk in async_gen:
+                            yield chunk
+                            # To allow for cancellation to trigger
+                            # Ref: https://github.com/fastapi/fastapi/issues/14680
+                            await anyio.sleep(0)
+
+                    gen = _async_stream_raw(gen)
+                response_args = _build_response_args(
+                    status_code=status_code, solved_result=solved_result
+                )
+                response = actual_response_class(content=gen, **response_args)
+                response.headers.raw.extend(solved_result.response.headers.raw)
+            else:
+                raw_response = await run_endpoint_function(
+                    dependant=dependant,
+                    values=solved_result.values,
+                    is_coroutine=is_coroutine,
+                )
+                if isinstance(raw_response, Response):
+                    if raw_response.background is None:
+                        raw_response.background = solved_result.background_tasks
+                    response = raw_response
+                else:
+                    response_args = _build_response_args(
+                        status_code=status_code, solved_result=solved_result
+                    )
+                    # Use the fast path (dump_json) when no custom response
+                    # class was set and a response field with a TypeAdapter
+                    # exists. Serializes directly to JSON bytes via Pydantic's
+                    # Rust core, skipping the intermediate Python dict +
+                    # json.dumps() step.
+                    use_dump_json = response_field is not None and isinstance(
+                        response_class, DefaultPlaceholder
+                    )
+                    content = await serialize_response(
+                        field=response_field,
+                        response_content=raw_response,
+                        include=response_model_include,
+                        exclude=response_model_exclude,
+                        by_alias=response_model_by_alias,
+                        exclude_unset=response_model_exclude_unset,
+                        exclude_defaults=response_model_exclude_defaults,
+                        exclude_none=response_model_exclude_none,
+                        is_coroutine=is_coroutine,
+                        endpoint_ctx=endpoint_ctx,
+                        dump_json=use_dump_json,
+                    )
+                    if use_dump_json:
+                        response = Response(
+                            content=content,
+                            media_type="application/json",
+                            **response_args,
+                        )
+                    else:
+                        response = actual_response_class(content, **response_args)
+                    if not is_body_allowed_for_status_code(response.status_code):
+                        response.body = b""
+                    response.headers.raw.extend(solved_result.response.headers.raw)
         if errors:
             validation_error = RequestValidationError(
                 errors, body=body, endpoint_ctx=endpoint_ctx
@@ -582,15 +697,25 @@ class APIRoute(routing.Route):
         openapi_extra: dict[str, Any] | None = None,
         generate_unique_id_function: Callable[["APIRoute"], str]
         | DefaultPlaceholder = Default(generate_unique_id),
+        strict_content_type: bool | DefaultPlaceholder = Default(True),
     ) -> None:
         self.path = path
         self.endpoint = endpoint
+        self.stream_item_type: Any | None = None
         if isinstance(response_model, DefaultPlaceholder):
             return_annotation = get_typed_return_annotation(endpoint)
             if lenient_issubclass(return_annotation, Response):
                 response_model = None
             else:
-                response_model = return_annotation
+                stream_item = get_stream_item_type(return_annotation)
+                if stream_item is not None:
+                    # Only extract item type for JSONL streaming when no
+                    # explicit response_class (e.g. StreamingResponse) was set
+                    if isinstance(response_class, DefaultPlaceholder):
+                        self.stream_item_type = stream_item
+                    response_model = None
+                else:
+                    response_model = return_annotation
         self.response_model = response_model
         self.summary = summary
         self.response_description = response_description
@@ -608,6 +733,7 @@ class APIRoute(routing.Route):
         self.callbacks = callbacks
         self.openapi_extra = openapi_extra
         self.generate_unique_id_function = generate_unique_id_function
+        self.strict_content_type = strict_content_type
         self.tags = tags or []
         self.responses = responses or {}
         self.name = get_name(endpoint) if name is None else name
@@ -638,6 +764,15 @@ class APIRoute(routing.Route):
             )
         else:
             self.response_field = None  # type: ignore
+        if self.stream_item_type:
+            stream_item_name = "StreamItem_" + self.unique_id
+            self.stream_item_field: ModelField | None = create_model_field(
+                name=stream_item_name,
+                type_=self.stream_item_type,
+                mode="serialization",
+            )
+        else:
+            self.stream_item_field = None
         self.dependencies = list(dependencies or [])
         self.description = description or inspect.cleandoc(self.endpoint.__doc__ or "")
         # if a "form feed" character (page break) is found in the description text,
@@ -679,6 +814,11 @@ class APIRoute(routing.Route):
             name=self.unique_id,
             embed_body_fields=self._embed_body_fields,
         )
+        # Detect generator endpoints that should stream as JSONL
+        # (only when no explicit response_class like StreamingResponse is set)
+        self.is_json_stream = isinstance(response_class, DefaultPlaceholder) and (
+            self.dependant.is_async_gen_callable or self.dependant.is_gen_callable
+        )
         self.app = request_response(self.get_route_handler())
 
     def get_route_handler(self) -> Callable[[Request], Coroutine[Any, Any, Response]]:
@@ -696,6 +836,9 @@ class APIRoute(routing.Route):
             response_model_exclude_none=self.response_model_exclude_none,
             dependency_overrides_provider=self.dependency_overrides_provider,
             embed_body_fields=self._embed_body_fields,
+            strict_content_type=self.strict_content_type,
+            stream_item_field=self.stream_item_field,
+            is_json_stream=self.is_json_stream,
         )
 
     def matches(self, scope: Scope) -> tuple[Match, Scope]:
@@ -946,6 +1089,29 @@ class APIRouter(routing.Router):
                 """
             ),
         ] = Default(generate_unique_id),
+        strict_content_type: Annotated[
+            bool,
+            Doc(
+                """
+                Enable strict checking for request Content-Type headers.
+
+                When `True` (the default), requests with a body that do not include
+                a `Content-Type` header will **not** be parsed as JSON.
+
+                This prevents potential cross-site request forgery (CSRF) attacks
+                that exploit the browser's ability to send requests without a
+                Content-Type header, bypassing CORS preflight checks. In particular
+                applicable for apps that need to be run locally (in localhost).
+
+                When `False`, requests without a `Content-Type` header will have
+                their body parsed as JSON, which maintains compatibility with
+                certain clients that don't send `Content-Type` headers.
+
+                Read more about it in the
+                [FastAPI docs for Strict Content-Type](https://fastapi.tiangolo.com/advanced/strict-content-type/).
+                """
+            ),
+        ] = Default(True),
     ) -> None:
         # Determine the lifespan context to use
         if lifespan is None:
@@ -992,6 +1158,7 @@ class APIRouter(routing.Router):
         self.route_class = route_class
         self.default_response_class = default_response_class
         self.generate_unique_id_function = generate_unique_id_function
+        self.strict_content_type = strict_content_type
 
     def route(
         self,
@@ -1042,6 +1209,7 @@ class APIRouter(routing.Router):
         openapi_extra: dict[str, Any] | None = None,
         generate_unique_id_function: Callable[[APIRoute], str]
         | DefaultPlaceholder = Default(generate_unique_id),
+        strict_content_type: bool | DefaultPlaceholder = Default(True),
     ) -> None:
         route_class = route_class_override or self.route_class
         responses = responses or {}
@@ -1088,6 +1256,9 @@ class APIRouter(routing.Router):
             callbacks=current_callbacks,
             openapi_extra=openapi_extra,
             generate_unique_id_function=current_generate_unique_id,
+            strict_content_type=get_value_or_default(
+                strict_content_type, self.strict_content_type
+            ),
         )
         self.routes.append(route)
 
@@ -1463,6 +1634,11 @@ class APIRouter(routing.Router):
                     callbacks=current_callbacks,
                     openapi_extra=route.openapi_extra,
                     generate_unique_id_function=current_generate_unique_id,
+                    strict_content_type=get_value_or_default(
+                        route.strict_content_type,
+                        router.strict_content_type,
+                        self.strict_content_type,
+                    ),
                 )
             elif isinstance(route, routing.Route):
                 methods = list(route.methods or [])

pdm_build.py

@@ -1,40 +0,0 @@
-import os
-from typing import Any
-
-from pdm.backend.hooks import Context
-
-TIANGOLO_BUILD_PACKAGE = os.getenv("TIANGOLO_BUILD_PACKAGE")
-
-
-def pdm_build_initialize(context: Context) -> None:
-    metadata = context.config.metadata
-    # Get main version
-    version = metadata["version"]
-    # Get custom config for the current package, from the env var
-    all_configs_config: dict[str, Any] = context.config.data["tool"]["tiangolo"][
-        "_internal-slim-build"
-    ]["packages"]
-
-    if TIANGOLO_BUILD_PACKAGE not in all_configs_config:
-        return
-
-    config = all_configs_config[TIANGOLO_BUILD_PACKAGE]
-    project_config: dict[str, Any] = config["project"]
-    # Override main [project] configs with custom configs for this package
-    for key, value in project_config.items():
-        metadata[key] = value
-    # Get custom build config for the current package
-    build_config: dict[str, Any] = (
-        config.get("tool", {}).get("pdm", {}).get("build", {})
-    )
-    # Override PDM build config with custom build config for this package
-    for key, value in build_config.items():
-        context.config.build_config[key] = value
-    # Get main dependencies
-    dependencies: list[str] = metadata.get("dependencies", [])
-    # Sync versions in dependencies
-    new_dependencies = []
-    for dep in dependencies:
-        new_dep = f"{dep}>={version}"
-        new_dependencies.append(new_dep)
-    metadata["dependencies"] = new_dependencies

pyproject.toml

@@ -42,7 +42,7 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
 ]
 dependencies = [
-    "starlette>=0.40.0,<1.0.0",
+    "starlette>=0.46.0",
     "pydantic>=2.7.0",
     "typing-extensions>=4.8.0",
     "typing-inspection>=0.4.2",
@@ -57,7 +57,6 @@ Issues = "https://github.com/fastapi/fastapi/issues"
 Changelog = "https://fastapi.tiangolo.com/release-notes/"
 
 [project.optional-dependencies]
-
 standard = [
     "fastapi-cli[standard] >=0.0.8",
     # For the test client
@@ -106,10 +105,6 @@ all = [
     "itsdangerous >=1.1.0",
     # For Starlette's schema generation, would not be used with FastAPI
     "pyyaml >=5.3.1",
-    # For UJSONResponse
-    "ujson >=5.8.0",
-    # For ORJSONResponse
-    "orjson >=3.9.3",
     # To validate email fields
     "email-validator >=2.0.0",
     # Uvicorn with uvloop
@@ -152,6 +147,10 @@ docs = [
 docs-tests = [
     "httpx >=0.23.0,<1.0.0",
     "ruff >=0.14.14",
+    # For UJSONResponse
+    "ujson >=5.8.0",
+    # For ORJSONResponse
+    "orjson >=3.9.3",
 ]
 github-actions = [
     "httpx >=0.27.0,<1.0.0",
@@ -164,14 +163,14 @@ github-actions = [
 tests = [
     { include-group = "docs-tests" },
     "anyio[trio] >=3.2.1,<5.0.0",
-    "coverage[toml] >=6.5.0,<8.0",
+    "coverage[toml] >=7.13,<8.0",
     "dirty-equals >=0.9.0",
     "flask >=3.0.0,<4.0.0",
     "inline-snapshot >=0.21.1",
     "mypy >=1.14.1",
     "pwdlib[argon2] >=0.2.1",
     "pyjwt >=2.9.0",
-    "pytest >=7.1.3,<9.0.0",
+    "pytest >=9.0.0",
     "pytest-codspeed >=4.2.0",
     "pyyaml >=5.3.1,<7.0.0",
     "sqlmodel >=0.0.31",
@@ -179,6 +178,10 @@ tests = [
     "types-orjson >=3.6.2",
     "types-ujson >=5.10.0.20240515",
     "a2wsgi >=1.9.0,<=2.0.0",
+    "pytest-xdist[psutil]>=2.5.0",
+    "pytest-cov>=4.0.0",
+    "pytest-sugar>=1.0.0",
+    "pytest-timeout>=2.4.0",
 ]
 translations = [
     "gitpython >=3.1.46",
@@ -199,32 +202,6 @@ source-includes = [
     "docs/en/docs/img/favicon.png",
 ]
 
-[tool.tiangolo._internal-slim-build.packages.fastapi-slim.project]
-name = "fastapi-slim"
-readme = "fastapi-slim/README.md"
-dependencies = [
-    "fastapi",
-]
-optional-dependencies = {}
-scripts = {}
-
-[tool.tiangolo._internal-slim-build.packages.fastapi-slim.tool.pdm.build]
-# excludes needs to explicitly exclude the top level python packages,
-# otherwise PDM includes them by default
-# A "*" glob pattern can't be used here because in PDM internals, the patterns are put
-# in a set (unordered, order varies) and each excluded file is assigned one of the
-# glob patterns that matches, as the set is unordered, the matched pattern could be "*"
-# independent of the order here. And then the internal code would give it a lower score
-# than the one for a default included file.
-# By not using "*" and explicitly excluding the top level packages, they get a higher
-# score than the default inclusion
-excludes = ["fastapi", "tests", "pdm_build.py"]
-# source-includes needs to explicitly define some value because PDM will check the
-# truthy value of the list, and if empty, will include some defaults, including "tests",
-# an empty string doesn't match anything, but makes the list truthy, so that PDM
-# doesn't override it during the build.
-source-includes = [""]
-
 [tool.mypy]
 plugins = ["pydantic.mypy"]
 strict = true
@@ -245,26 +222,18 @@ disallow_incomplete_defs = false
 disallow_untyped_defs = false
 disallow_untyped_calls = false
 
-[tool.pytest.ini_options]
+[tool.pytest]
+minversion = "9.0"
 addopts = [
   "--strict-config",
   "--strict-markers",
   "--ignore=docs_src",
 ]
-xfail_strict = true
+strict_xfail = true
-junit_family = "xunit2"
 filterwarnings = [
     "error",
-    # see https://trio.readthedocs.io/en/stable/history.html#trio-0-22-0-2022-09-28
-    "ignore:You seem to already have a custom.*:RuntimeWarning:trio",
-    # TODO: remove after upgrading SQLAlchemy to a version that includes the following changes
-    # https://github.com/sqlalchemy/sqlalchemy/commit/59521abcc0676e936b31a523bd968fc157fef0c2
-    'ignore:datetime\.datetime\.utcfromtimestamp\(\) is deprecated and scheduled for removal in a future version\..*:DeprecationWarning:sqlalchemy',
-    # Trio 24.1.0 raises a warning from attrs
-    # Ref: https://github.com/python-trio/trio/pull/3054
-    # Remove once there's a new version of Trio
-    'ignore:The `hash` argument is deprecated*:DeprecationWarning:trio',
 ]
+timeout = "20"
 
 [tool.coverage.run]
 parallel = true
@@ -276,11 +245,10 @@ source = [
 ]
 relative_files = true
 context = '${CONTEXT}'
-dynamic_context = "test_function"
 omit = [
+    "tests/benchmarks/*",
     "docs_src/response_model/tutorial003_04_py39.py",
     "docs_src/response_model/tutorial003_04_py310.py",
-    "docs_src/dependencies/tutorial008_an_py39.py",  # difficult to mock
     "docs_src/dependencies/tutorial013_an_py310.py",  # temporary code example?
     "docs_src/dependencies/tutorial014_an_py310.py",  # temporary code example?
     # Pydantic v1 migration, no longer tested
@@ -288,202 +256,6 @@ omit = [
     "docs_src/pydantic_v1_in_v2/tutorial002_an_py310.py",
     "docs_src/pydantic_v1_in_v2/tutorial003_an_py310.py",
     "docs_src/pydantic_v1_in_v2/tutorial004_an_py310.py",
-    # TODO: remove all the ignores below when all translations use the new Python 3.10 files
-    "docs_src/additional_responses/tutorial001_py39.py",
-    "docs_src/additional_responses/tutorial003_py39.py",
-    "docs_src/advanced_middleware/tutorial001_py39.py",
-    "docs_src/advanced_middleware/tutorial002_py39.py",
-    "docs_src/advanced_middleware/tutorial003_py39.py",
-    "docs_src/app_testing/app_a_py39/main.py",
-    "docs_src/app_testing/app_a_py39/test_main.py",
-    "docs_src/app_testing/tutorial001_py39.py",
-    "docs_src/app_testing/tutorial002_py39.py",
-    "docs_src/app_testing/tutorial003_py39.py",
-    "docs_src/app_testing/tutorial004_py39.py",
-    "docs_src/async_tests/app_a_py39/main.py",
-    "docs_src/async_tests/app_a_py39/test_main.py",
-    "docs_src/authentication_error_status_code/tutorial001_an_py39.py",
-    "docs_src/background_tasks/tutorial001_py39.py",
-    "docs_src/behind_a_proxy/tutorial001_01_py39.py",
-    "docs_src/behind_a_proxy/tutorial001_py39.py",
-    "docs_src/behind_a_proxy/tutorial002_py39.py",
-    "docs_src/behind_a_proxy/tutorial003_py39.py",
-    "docs_src/behind_a_proxy/tutorial004_py39.py",
-    "docs_src/bigger_applications/app_an_py39/dependencies.py",
-    "docs_src/bigger_applications/app_an_py39/internal/admin.py",
-    "docs_src/bigger_applications/app_an_py39/main.py",
-    "docs_src/bigger_applications/app_an_py39/routers/items.py",
-    "docs_src/bigger_applications/app_an_py39/routers/users.py",
-    "docs_src/bigger_applications/app_py39/dependencies.py",
-    "docs_src/bigger_applications/app_py39/main.py",
-    "docs_src/body_nested_models/tutorial008_py39.py",
-    "docs_src/body_nested_models/tutorial009_py39.py",
-    "docs_src/conditional_openapi/tutorial001_py39.py",
-    "docs_src/configure_swagger_ui/tutorial001_py39.py",
-    "docs_src/configure_swagger_ui/tutorial002_py39.py",
-    "docs_src/configure_swagger_ui/tutorial003_py39.py",
-    "docs_src/cors/tutorial001_py39.py",
-    "docs_src/custom_docs_ui/tutorial001_py39.py",
-    "docs_src/custom_docs_ui/tutorial002_py39.py",
-    "docs_src/custom_response/tutorial001_py39.py",
-    "docs_src/custom_response/tutorial001b_py39.py",
-    "docs_src/custom_response/tutorial002_py39.py",
-    "docs_src/custom_response/tutorial003_py39.py",
-    "docs_src/custom_response/tutorial004_py39.py",
-    "docs_src/custom_response/tutorial005_py39.py",
-    "docs_src/custom_response/tutorial006_py39.py",
-    "docs_src/custom_response/tutorial006b_py39.py",
-    "docs_src/custom_response/tutorial006c_py39.py",
-    "docs_src/custom_response/tutorial007_py39.py",
-    "docs_src/custom_response/tutorial008_py39.py",
-    "docs_src/custom_response/tutorial009_py39.py",
-    "docs_src/custom_response/tutorial009b_py39.py",
-    "docs_src/custom_response/tutorial009c_py39.py",
-    "docs_src/custom_response/tutorial010_py39.py",
-    "docs_src/debugging/tutorial001_py39.py",
-    "docs_src/dependencies/tutorial006_an_py39.py",
-    "docs_src/dependencies/tutorial006_py39.py",
-    "docs_src/dependencies/tutorial007_py39.py",
-    "docs_src/dependencies/tutorial008_py39.py",
-    "docs_src/dependencies/tutorial008b_an_py39.py",
-    "docs_src/dependencies/tutorial008b_py39.py",
-    "docs_src/dependencies/tutorial008c_an_py39.py",
-    "docs_src/dependencies/tutorial008c_py39.py",
-    "docs_src/dependencies/tutorial008d_an_py39.py",
-    "docs_src/dependencies/tutorial008d_py39.py",
-    "docs_src/dependencies/tutorial008e_an_py39.py",
-    "docs_src/dependencies/tutorial008e_py39.py",
-    "docs_src/dependencies/tutorial010_py39.py",
-    "docs_src/dependencies/tutorial011_an_py39.py",
-    "docs_src/dependencies/tutorial011_py39.py",
-    "docs_src/dependencies/tutorial012_an_py39.py",
-    "docs_src/dependencies/tutorial012_py39.py",
-    "docs_src/events/tutorial001_py39.py",
-    "docs_src/events/tutorial002_py39.py",
-    "docs_src/events/tutorial003_py39.py",
-    "docs_src/extending_openapi/tutorial001_py39.py",
-    "docs_src/extra_models/tutorial004_py39.py",
-    "docs_src/extra_models/tutorial005_py39.py",
-    "docs_src/first_steps/tutorial001_py39.py",
-    "docs_src/first_steps/tutorial003_py39.py",
-    "docs_src/generate_clients/tutorial001_py39.py",
-    "docs_src/generate_clients/tutorial002_py39.py",
-    "docs_src/generate_clients/tutorial003_py39.py",
-    "docs_src/generate_clients/tutorial004_py39.py",
-    "docs_src/graphql_/tutorial001_py39.py",
-    "docs_src/handling_errors/tutorial001_py39.py",
-    "docs_src/handling_errors/tutorial002_py39.py",
-    "docs_src/handling_errors/tutorial003_py39.py",
-    "docs_src/handling_errors/tutorial004_py39.py",
-    "docs_src/handling_errors/tutorial005_py39.py",
-    "docs_src/handling_errors/tutorial006_py39.py",
-    "docs_src/metadata/tutorial001_1_py39.py",
-    "docs_src/metadata/tutorial001_py39.py",
-    "docs_src/metadata/tutorial002_py39.py",
-    "docs_src/metadata/tutorial003_py39.py",
-    "docs_src/metadata/tutorial004_py39.py",
-    "docs_src/middleware/tutorial001_py39.py",
-    "docs_src/openapi_webhooks/tutorial001_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial001_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial002_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial003_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial005_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial006_py39.py",
-    "docs_src/path_operation_advanced_configuration/tutorial007_py39.py",
-    "docs_src/path_operation_configuration/tutorial002b_py39.py",
-    "docs_src/path_operation_configuration/tutorial006_py39.py",
-    "docs_src/path_params/tutorial001_py39.py",
-    "docs_src/path_params/tutorial002_py39.py",
-    "docs_src/path_params/tutorial003_py39.py",
-    "docs_src/path_params/tutorial003b_py39.py",
-    "docs_src/path_params/tutorial004_py39.py",
-    "docs_src/path_params/tutorial005_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial002_an_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial002_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial003_an_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial003_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial004_an_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial004_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial005_an_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial005_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial006_an_py39.py",
-    "docs_src/path_params_numeric_validations/tutorial006_py39.py",
-    "docs_src/python_types/tutorial001_py39.py",
-    "docs_src/python_types/tutorial002_py39.py",
-    "docs_src/python_types/tutorial003_py39.py",
-    "docs_src/python_types/tutorial004_py39.py",
-    "docs_src/python_types/tutorial005_py39.py",
-    "docs_src/python_types/tutorial006_py39.py",
-    "docs_src/python_types/tutorial007_py39.py",
-    "docs_src/python_types/tutorial008_py39.py",
-    "docs_src/python_types/tutorial008b_py39.py",
-    "docs_src/python_types/tutorial009_py39.py",
-    "docs_src/python_types/tutorial009b_py39.py",
-    "docs_src/python_types/tutorial009c_py39.py",
-    "docs_src/python_types/tutorial010_py39.py",
-    "docs_src/python_types/tutorial013_py39.py",
-    "docs_src/query_params/tutorial001_py39.py",
-    "docs_src/query_params/tutorial005_py39.py",
-    "docs_src/query_params_str_validations/tutorial005_an_py39.py",
-    "docs_src/query_params_str_validations/tutorial005_py39.py",
-    "docs_src/query_params_str_validations/tutorial006_an_py39.py",
-    "docs_src/query_params_str_validations/tutorial006_py39.py",
-    "docs_src/query_params_str_validations/tutorial012_an_py39.py",
-    "docs_src/query_params_str_validations/tutorial012_py39.py",
-    "docs_src/query_params_str_validations/tutorial013_an_py39.py",
-    "docs_src/query_params_str_validations/tutorial013_py39.py",
-    "docs_src/request_files/tutorial001_03_an_py39.py",
-    "docs_src/request_files/tutorial001_03_py39.py",
-    "docs_src/request_files/tutorial001_an_py39.py",
-    "docs_src/request_files/tutorial001_py39.py",
-    "docs_src/request_files/tutorial002_an_py39.py",
-    "docs_src/request_files/tutorial002_py39.py",
-    "docs_src/request_files/tutorial003_an_py39.py",
-    "docs_src/request_files/tutorial003_py39.py",
-    "docs_src/request_form_models/tutorial001_an_py39.py",
-    "docs_src/request_form_models/tutorial001_py39.py",
-    "docs_src/request_form_models/tutorial002_an_py39.py",
-    "docs_src/request_form_models/tutorial002_py39.py",
-    "docs_src/request_forms/tutorial001_an_py39.py",
-    "docs_src/request_forms/tutorial001_py39.py",
-    "docs_src/request_forms_and_files/tutorial001_an_py39.py",
-    "docs_src/request_forms_and_files/tutorial001_py39.py",
-    "docs_src/response_change_status_code/tutorial001_py39.py",
-    "docs_src/response_cookies/tutorial001_py39.py",
-    "docs_src/response_cookies/tutorial002_py39.py",
-    "docs_src/response_directly/tutorial002_py39.py",
-    "docs_src/response_headers/tutorial001_py39.py",
-    "docs_src/response_headers/tutorial002_py39.py",
-    "docs_src/response_model/tutorial003_02_py39.py",
-    "docs_src/response_model/tutorial003_03_py39.py",
-    "docs_src/response_status_code/tutorial001_py39.py",
-    "docs_src/response_status_code/tutorial002_py39.py",
-    "docs_src/security/tutorial001_an_py39.py",
-    "docs_src/security/tutorial001_py39.py",
-    "docs_src/security/tutorial006_an_py39.py",
-    "docs_src/security/tutorial006_py39.py",
-    "docs_src/security/tutorial007_an_py39.py",
-    "docs_src/security/tutorial007_py39.py",
-    "docs_src/settings/app01_py39/config.py",
-    "docs_src/settings/app01_py39/main.py",
-    "docs_src/settings/app02_an_py39/config.py",
-    "docs_src/settings/app02_an_py39/main.py",
-    "docs_src/settings/app02_an_py39/test_main.py",
-    "docs_src/settings/app02_py39/config.py",
-    "docs_src/settings/app02_py39/main.py",
-    "docs_src/settings/app02_py39/test_main.py",
-    "docs_src/settings/app03_an_py39/config.py",
-    "docs_src/settings/app03_an_py39/main.py",
-    "docs_src/settings/app03_py39/config.py",
-    "docs_src/settings/app03_py39/main.py",
-    "docs_src/settings/tutorial001_py39.py",
-    "docs_src/static_files/tutorial001_py39.py",
-    "docs_src/sub_applications/tutorial001_py39.py",
-    "docs_src/templates/tutorial001_py39.py",
-    "docs_src/using_request_directly/tutorial001_py39.py",
-    "docs_src/websockets/tutorial001_py39.py",
-    "docs_src/websockets/tutorial003_py39.py",
-    "docs_src/wsgi/tutorial001_py39.py",
 ]
 
 [tool.coverage.report]
@@ -548,6 +320,10 @@ ignore = [
 "docs_src/security/tutorial005_an_py39.py" = ["B904"]
 "docs_src/security/tutorial005_py310.py" = ["B904"]
 "docs_src/security/tutorial005_py39.py" = ["B904"]
+"docs_src/json_base64_bytes/tutorial001_py310.py" = ["UP012"]
+"docs_src/stream_json_lines/tutorial001_py310.py" = ["UP028"]
+"docs_src/stream_data/tutorial001_py310.py" = ["UP028"]
+"docs_src/stream_data/tutorial002_py310.py" = ["UP028"]
 
 [tool.ruff.lint.isort]
 known-third-party = ["fastapi", "pydantic", "starlette"]

scripts/people.py

@@ -5,6 +5,7 @@ import time
 from collections import Counter
 from collections.abc import Container
 from datetime import datetime, timedelta, timezone
+from math import ceil
 from pathlib import Path
 from typing import Any
 
@@ -15,12 +16,63 @@ from pydantic import BaseModel, SecretStr
 from pydantic_settings import BaseSettings
 
 github_graphql_url = "https://api.github.com/graphql"
-questions_category_id = "MDE4OkRpc2N1c3Npb25DYXRlZ29yeTMyMDAxNDM0"
+questions_category_id = "DIC_kwDOCZduT84B6E2a"
+
+
+POINTS_PER_MINUTE_LIMIT = 84  # 5000 points per hour
+
+
+class RateLimiter:
+    def __init__(self) -> None:
+        self.last_query_cost: int = 1
+        self.remaining_points: int = 5000
+        self.reset_at: datetime = datetime.fromtimestamp(0, timezone.utc)
+        self.last_request_start_time: datetime = datetime.fromtimestamp(0, timezone.utc)
+        self.speed_multiplier: float = 1.0
+
+    def __enter__(self) -> "RateLimiter":
+        now = datetime.now(tz=timezone.utc)
+
+        # Handle primary rate limits
+        primary_limit_wait_time = 0.0
+        if self.remaining_points <= self.last_query_cost:
+            primary_limit_wait_time = (self.reset_at - now).total_seconds() + 2
+            logging.warning(
+                f"Approaching GitHub API rate limit, remaining points: {self.remaining_points}, "
+                f"reset time in {primary_limit_wait_time} seconds"
+            )
+
+        # Handle secondary rate limits
+        secondary_limit_wait_time = 0.0
+        points_per_minute = POINTS_PER_MINUTE_LIMIT * self.speed_multiplier
+        interval = 60 / (points_per_minute / self.last_query_cost)
+        time_since_last_request = (now - self.last_request_start_time).total_seconds()
+        if time_since_last_request < interval:
+            secondary_limit_wait_time = interval - time_since_last_request
+
+        final_wait_time = ceil(max(primary_limit_wait_time, secondary_limit_wait_time))
+        logging.info(f"Sleeping for {final_wait_time} seconds to respect rate limit")
+        time.sleep(max(final_wait_time, 1))
+
+        self.last_request_start_time = datetime.now(tz=timezone.utc)
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
+        pass
+
+    def update_request_info(self, cost: int, remaining: int, reset_at: str) -> None:
+        self.last_query_cost = cost
+        self.remaining_points = remaining
+        self.reset_at = datetime.fromisoformat(reset_at.replace("Z", "+00:00"))
+
+
+rate_limiter = RateLimiter()
+
 
 discussions_query = """
 query Q($after: String, $category_id: ID) {
   repository(name: "fastapi", owner: "fastapi") {
-    discussions(first: 100, after: $after, categoryId: $category_id) {
+    discussions(first: 30, after: $after, categoryId: $category_id) {
       edges {
         cursor
         node {
@@ -58,6 +110,11 @@ query Q($after: String, $category_id: ID) {
       }
     }
   }
+  rateLimit {
+    cost
+    remaining
+    resetAt
+  }
 }
 """
 
@@ -120,7 +177,7 @@ class Settings(BaseSettings):
     github_token: SecretStr
     github_repository: str
     httpx_timeout: int = 30
-    sleep_interval: int = 5
+    speed_multiplier: float = 1.0
 
 
 def get_graphql_response(
@@ -158,11 +215,18 @@ def get_graphql_question_discussion_edges(
     settings: Settings,
     after: str | None = None,
 ) -> list[DiscussionsEdge]:
-    data = get_graphql_response(
+    with rate_limiter:
-        settings=settings,
+        data = get_graphql_response(
-        query=discussions_query,
+            settings=settings,
-        after=after,
+            query=discussions_query,
-        category_id=questions_category_id,
+            after=after,
+            category_id=questions_category_id,
+        )
+
+    rate_limiter.update_request_info(
+        cost=data["data"]["rateLimit"]["cost"],
+        remaining=data["data"]["rateLimit"]["remaining"],
+        reset_at=data["data"]["rateLimit"]["resetAt"],
     )
     graphql_response = DiscussionsResponse.model_validate(data)
     return graphql_response.data.repository.discussions.edges
@@ -185,8 +249,6 @@ def get_discussion_nodes(settings: Settings) -> list[DiscussionsNode]:
         for discussion_edge in discussion_edges:
             discussion_nodes.append(discussion_edge.node)
         last_edge = discussion_edges[-1]
-        # Handle GitHub secondary rate limits, requests per minute
-        time.sleep(settings.sleep_interval)
         discussion_edges = get_graphql_question_discussion_edges(
             settings=settings, after=last_edge.cursor
         )
@@ -318,6 +380,7 @@ def main() -> None:
     logging.basicConfig(level=logging.INFO)
     settings = Settings()
     logging.info(f"Using config: {settings.model_dump_json()}")
+    rate_limiter.speed_multiplier = settings.speed_multiplier
     g = Github(settings.github_token.get_secret_value())
     repo = g.get_repo(settings.github_repository)
 

scripts/playwright/json_base64_bytes/image01.py

@@ -0,0 +1,37 @@
+import subprocess
+import time
+
+import httpx
+from playwright.sync_api import Playwright, sync_playwright
+
+
+# Run playwright codegen to generate the code below, copy paste the sections in run()
+def run(playwright: Playwright) -> None:
+    browser = playwright.chromium.launch(headless=False)
+    # Update the viewport manually
+    context = browser.new_context(viewport={"width": 960, "height": 1080})
+    page = context.new_page()
+    page.goto("http://localhost:8000/docs")
+    page.get_by_role("button", name="POST /data Post Data").click()
+    # Manually add the screenshot
+    page.screenshot(path="docs/en/docs/img/tutorial/json-base64-bytes/image01.png")
+
+    # ---------------------
+    context.close()
+    browser.close()
+
+
+process = subprocess.Popen(
+    ["fastapi", "run", "docs_src/json_base64_bytes/tutorial001_py310.py"]
+)
+try:
+    for _ in range(3):
+        try:
+            response = httpx.get("http://localhost:8000/docs")
+        except httpx.ConnectError:
+            time.sleep(1)
+            break
+    with sync_playwright() as playwright:
+        run(playwright)
+finally:
+    process.terminate()

scripts/test-cov-html.sh

@@ -3,5 +3,4 @@
 set -e
 set -x
 
-bash scripts/test.sh ${@}
+bash scripts/test-cov.sh --cov-report=term-missing --cov-report=html ${@}
-bash scripts/coverage.sh

scripts/test-cov.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+bash scripts/test.sh --cov --cov-context=test ${@}

scripts/test.sh

@@ -4,4 +4,4 @@ set -e
 set -x
 
 export PYTHONPATH=./docs_src
-coverage run -m pytest tests scripts/tests/ ${@}
+pytest -n auto --dist loadgroup  tests scripts/tests/ ${@}

scripts/tests/test_translation_fixer/conftest.py

@@ -10,9 +10,17 @@ skip_on_windows = pytest.mark.skipif(
 )
 
 
-def pytest_collection_modifyitems(items: list[pytest.Item]) -> None:
+THIS_DIR = Path(__file__).parent.resolve()
+
+
+def pytest_collection_modifyitems(config, items: list[pytest.Item]) -> None:
+    if sys.platform != "win32":
+        return
+
     for item in items:
-        item.add_marker(skip_on_windows)
+        item_path = Path(item.fspath).resolve()
+        if item_path.is_relative_to(THIS_DIR):
+            item.add_marker(skip_on_windows)
 
 
 @pytest.fixture(name="runner")

tests/test_deprecated_responses.py

@@ -0,0 +1,73 @@
+import warnings
+
+import pytest
+from fastapi import FastAPI
+from fastapi.exceptions import FastAPIDeprecationWarning
+from fastapi.responses import ORJSONResponse, UJSONResponse
+from fastapi.testclient import TestClient
+from pydantic import BaseModel
+
+
+class Item(BaseModel):
+    name: str
+    price: float
+
+
+# ORJSON
+
+
+def _make_orjson_app() -> FastAPI:
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+        app = FastAPI(default_response_class=ORJSONResponse)
+
+    @app.get("/items")
+    def get_items() -> Item:
+        return Item(name="widget", price=9.99)
+
+    return app
+
+
+def test_orjson_response_returns_correct_data():
+    app = _make_orjson_app()
+    client = TestClient(app)
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+        response = client.get("/items")
+    assert response.status_code == 200
+    assert response.json() == {"name": "widget", "price": 9.99}
+
+
+def test_orjson_response_emits_deprecation_warning():
+    with pytest.warns(FastAPIDeprecationWarning, match="ORJSONResponse is deprecated"):
+        ORJSONResponse(content={"hello": "world"})
+
+
+# UJSON
+
+
+def _make_ujson_app() -> FastAPI:
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+        app = FastAPI(default_response_class=UJSONResponse)
+
+    @app.get("/items")
+    def get_items() -> Item:
+        return Item(name="widget", price=9.99)
+
+    return app
+
+
+def test_ujson_response_returns_correct_data():
+    app = _make_ujson_app()
+    client = TestClient(app)
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+        response = client.get("/items")
+    assert response.status_code == 200
+    assert response.json() == {"name": "widget", "price": 9.99}
+
+
+def test_ujson_response_emits_deprecation_warning():
+    with pytest.warns(FastAPIDeprecationWarning, match="UJSONResponse is deprecated"):
+        UJSONResponse(content={"hello": "world"})

tests/test_dump_json_fast_path.py

@@ -0,0 +1,51 @@
+from unittest.mock import patch
+
+from fastapi import FastAPI
+from fastapi.responses import JSONResponse
+from fastapi.testclient import TestClient
+from pydantic import BaseModel
+
+
+class Item(BaseModel):
+    name: str
+    price: float
+
+
+app = FastAPI()
+
+
+@app.get("/default")
+def get_default() -> Item:
+    return Item(name="widget", price=9.99)
+
+
+@app.get("/explicit", response_class=JSONResponse)
+def get_explicit() -> Item:
+    return Item(name="widget", price=9.99)
+
+
+client = TestClient(app)
+
+
+def test_default_response_class_skips_json_dumps():
+    """When no response_class is set, the fast path serializes directly to
+    JSON bytes via Pydantic's dump_json and never calls json.dumps."""
+    with patch(
+        "starlette.responses.json.dumps", wraps=__import__("json").dumps
+    ) as mock_dumps:
+        response = client.get("/default")
+    assert response.status_code == 200
+    assert response.json() == {"name": "widget", "price": 9.99}
+    mock_dumps.assert_not_called()
+
+
+def test_explicit_response_class_uses_json_dumps():
+    """When response_class is explicitly set to JSONResponse, the normal path
+    is used and json.dumps is called via JSONResponse.render()."""
+    with patch(
+        "starlette.responses.json.dumps", wraps=__import__("json").dumps
+    ) as mock_dumps:
+        response = client.get("/explicit")
+    assert response.status_code == 200
+    assert response.json() == {"name": "widget", "price": 9.99}
+    mock_dumps.assert_called_once()

tests/test_openapi_cache_root_path.py

@@ -0,0 +1,75 @@
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+
+def test_root_path_does_not_persist_across_requests():
+    app = FastAPI()
+
+    @app.get("/")
+    def read_root():  # pragma: no cover
+        return {"ok": True}
+
+    # Attacker request with a spoofed root_path
+    attacker_client = TestClient(app, root_path="/evil-api")
+    response1 = attacker_client.get("/openapi.json")
+    data1 = response1.json()
+    assert any(s.get("url") == "/evil-api" for s in data1.get("servers", []))
+
+    # Subsequent legitimate request with no root_path
+    clean_client = TestClient(app)
+    response2 = clean_client.get("/openapi.json")
+    data2 = response2.json()
+    servers = [s.get("url") for s in data2.get("servers", [])]
+    assert "/evil-api" not in servers
+
+
+def test_multiple_different_root_paths_do_not_accumulate():
+    app = FastAPI()
+
+    @app.get("/")
+    def read_root():  # pragma: no cover
+        return {"ok": True}
+
+    for prefix in ["/path-a", "/path-b", "/path-c"]:
+        c = TestClient(app, root_path=prefix)
+        c.get("/openapi.json")
+
+    # A clean request should not have any of them
+    clean_client = TestClient(app)
+    response = clean_client.get("/openapi.json")
+    data = response.json()
+    servers = [s.get("url") for s in data.get("servers", [])]
+    for prefix in ["/path-a", "/path-b", "/path-c"]:
+        assert prefix not in servers, (
+            f"root_path '{prefix}' leaked into clean request: {servers}"
+        )
+
+
+def test_legitimate_root_path_still_appears():
+    app = FastAPI()
+
+    @app.get("/")
+    def read_root():  # pragma: no cover
+        return {"ok": True}
+
+    client = TestClient(app, root_path="/api/v1")
+    response = client.get("/openapi.json")
+    data = response.json()
+    servers = [s.get("url") for s in data.get("servers", [])]
+    assert "/api/v1" in servers
+
+
+def test_configured_servers_not_mutated():
+    configured_servers = [{"url": "https://prod.example.com"}]
+    app = FastAPI(servers=configured_servers)
+
+    @app.get("/")
+    def read_root():  # pragma: no cover
+        return {"ok": True}
+
+    # Request with a rogue root_path
+    attacker_client = TestClient(app, root_path="/evil")
+    attacker_client.get("/openapi.json")
+
+    # The original servers list must be untouched
+    assert configured_servers == [{"url": "https://prod.example.com"}]

tests/test_orjson_response_class.py

@@ -1,9 +1,14 @@
+import warnings
+
 from fastapi import FastAPI
+from fastapi.exceptions import FastAPIDeprecationWarning
 from fastapi.responses import ORJSONResponse
 from fastapi.testclient import TestClient
 from sqlalchemy.sql.elements import quoted_name
 
-app = FastAPI(default_response_class=ORJSONResponse)
+with warnings.catch_warnings():
+    warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+    app = FastAPI(default_response_class=ORJSONResponse)
 
 
 @app.get("/orjson_non_str_keys")
@@ -16,6 +21,8 @@ client = TestClient(app)
 
 
 def test_orjson_non_str_keys():
-    with client:
+    with warnings.catch_warnings():
-        response = client.get("/orjson_non_str_keys")
+        warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+        with client:
+            response = client.get("/orjson_non_str_keys")
     assert response.json() == {"msg": "Hello World", "1": 1}

tests/test_request_params/test_file/test_list.py

@@ -37,7 +37,10 @@ def test_list_schema(path: str):
         "properties": {
             "p": {
                 "type": "array",
-                "items": {"type": "string", "format": "binary"},
+                "items": {
+                    "type": "string",
+                    "contentMediaType": "application/octet-stream",
+                },
                 "title": "P",
             },
         },
@@ -115,7 +118,10 @@ def test_list_alias_schema(path: str):
         "properties": {
             "p_alias": {
                 "type": "array",
-                "items": {"type": "string", "format": "binary"},
+                "items": {
+                    "type": "string",
+                    "contentMediaType": "application/octet-stream",
+                },
                 "title": "P Alias",
             },
         },
@@ -221,7 +227,10 @@ def test_list_validation_alias_schema(path: str):
         "properties": {
             "p_val_alias": {
                 "type": "array",
-                "items": {"type": "string", "format": "binary"},
+                "items": {
+                    "type": "string",
+                    "contentMediaType": "application/octet-stream",
+                },
                 "title": "P Val Alias",
             },
         },
@@ -338,7 +347,10 @@ def test_list_alias_and_validation_alias_schema(path: str):
         "properties": {
             "p_val_alias": {
                 "type": "array",
-                "items": {"type": "string", "format": "binary"},
+                "items": {
+                    "type": "string",
+                    "contentMediaType": "application/octet-stream",
+                },
                 "title": "P Val Alias",
             },
         },

tests/test_request_params/test_file/test_optional.py

@@ -37,7 +37,7 @@ def test_optional_schema(path: str):
         "properties": {
             "p": {
                 "anyOf": [
-                    {"type": "string", "format": "binary"},
+                    {"type": "string", "contentMediaType": "application/octet-stream"},
                     {"type": "null"},
                 ],
                 "title": "P",
@@ -109,7 +109,7 @@ def test_optional_alias_schema(path: str):
         "properties": {
             "p_alias": {
                 "anyOf": [
-                    {"type": "string", "format": "binary"},
+                    {"type": "string", "contentMediaType": "application/octet-stream"},
                     {"type": "null"},
                 ],
                 "title": "P Alias",
@@ -200,7 +200,7 @@ def test_optional_validation_alias_schema(path: str):
         "properties": {
             "p_val_alias": {
                 "anyOf": [
-                    {"type": "string", "format": "binary"},
+                    {"type": "string", "contentMediaType": "application/octet-stream"},
                     {"type": "null"},
                 ],
                 "title": "P Val Alias",
@@ -296,7 +296,7 @@ def test_optional_alias_and_validation_alias_schema(path: str):
         "properties": {
             "p_val_alias": {
                 "anyOf": [
-                    {"type": "string", "format": "binary"},
+                    {"type": "string", "contentMediaType": "application/octet-stream"},
                     {"type": "null"},
                 ],
                 "title": "P Val Alias",

tests/test_request_params/test_file/test_optional_list.py

@@ -41,7 +41,10 @@ def test_optional_list_schema(path: str):
                 "anyOf": [
                     {
                         "type": "array",
-                        "items": {"type": "string", "format": "binary"},
+                        "items": {
+                            "type": "string",
+                            "contentMediaType": "application/octet-stream",
+                        },
                     },
                     {"type": "null"},
                 ],
@@ -116,7 +119,10 @@ def test_optional_list_alias_schema(path: str):
                 "anyOf": [
                     {
                         "type": "array",
-                        "items": {"type": "string", "format": "binary"},
+                        "items": {
+                            "type": "string",
+                            "contentMediaType": "application/octet-stream",
+                        },
                     },
                     {"type": "null"},
                 ],
@@ -205,7 +211,10 @@ def test_optional_validation_alias_schema(path: str):
                 "anyOf": [
                     {
                         "type": "array",
-                        "items": {"type": "string", "format": "binary"},
+                        "items": {
+                            "type": "string",
+                            "contentMediaType": "application/octet-stream",
+                        },
                     },
                     {"type": "null"},
                 ],
@@ -301,7 +310,10 @@ def test_optional_list_alias_and_validation_alias_schema(path: str):
                 "anyOf": [
                     {
                         "type": "array",
-                        "items": {"type": "string", "format": "binary"},
+                        "items": {
+                            "type": "string",
+                            "contentMediaType": "application/octet-stream",
+                        },
                     },
                     {"type": "null"},
                 ],

tests/test_request_params/test_file/test_required.py

@@ -35,7 +35,11 @@ def test_required_schema(path: str):
 
     assert app.openapi()["components"]["schemas"][body_model_name] == {
         "properties": {
-            "p": {"title": "P", "type": "string", "format": "binary"},
+            "p": {
+                "title": "P",
+                "type": "string",
+                "contentMediaType": "application/octet-stream",
+            },
         },
         "required": ["p"],
         "title": body_model_name,
@@ -109,7 +113,11 @@ def test_required_alias_schema(path: str):
 
     assert app.openapi()["components"]["schemas"][body_model_name] == {
         "properties": {
-            "p_alias": {"title": "P Alias", "type": "string", "format": "binary"},
+            "p_alias": {
+                "title": "P Alias",
+                "type": "string",
+                "contentMediaType": "application/octet-stream",
+            },
         },
         "required": ["p_alias"],
         "title": body_model_name,
@@ -216,7 +224,7 @@ def test_required_validation_alias_schema(path: str):
             "p_val_alias": {
                 "title": "P Val Alias",
                 "type": "string",
-                "format": "binary",
+                "contentMediaType": "application/octet-stream",
             },
         },
         "required": ["p_val_alias"],
@@ -329,7 +337,7 @@ def test_required_alias_and_validation_alias_schema(path: str):
             "p_val_alias": {
                 "title": "P Val Alias",
                 "type": "string",
-                "format": "binary",
+                "contentMediaType": "application/octet-stream",
             },
         },
         "required": ["p_val_alias"],

tests/test_stream_bare_type.py

@@ -0,0 +1,42 @@
+import json
+from typing import AsyncIterable, Iterable  # noqa: UP035 to test coverage
+
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from pydantic import BaseModel
+
+
+class Item(BaseModel):
+    name: str
+
+
+app = FastAPI()
+
+
+@app.get("/items/stream-bare-async")
+async def stream_bare_async() -> AsyncIterable:
+    yield {"name": "foo"}
+
+
+@app.get("/items/stream-bare-sync")
+def stream_bare_sync() -> Iterable:
+    yield {"name": "bar"}
+
+
+client = TestClient(app)
+
+
+def test_stream_bare_async_iterable():
+    response = client.get("/items/stream-bare-async")
+    assert response.status_code == 200
+    assert response.headers["content-type"] == "application/jsonl"
+    lines = [json.loads(line) for line in response.text.strip().splitlines()]
+    assert lines == [{"name": "foo"}]
+
+
+def test_stream_bare_sync_iterable():
+    response = client.get("/items/stream-bare-sync")
+    assert response.status_code == 200
+    assert response.headers["content-type"] == "application/jsonl"
+    lines = [json.loads(line) for line in response.text.strip().splitlines()]
+    assert lines == [{"name": "bar"}]

tests/test_stream_cancellation.py

@@ -0,0 +1,88 @@
+"""
+Test that async streaming endpoints can be cancelled without hanging.
+
+Ref: https://github.com/fastapi/fastapi/issues/14680
+"""
+
+from collections.abc import AsyncIterable
+
+import anyio
+import pytest
+from fastapi import FastAPI
+from fastapi.responses import StreamingResponse
+
+pytestmark = [
+    pytest.mark.anyio,
+    pytest.mark.filterwarnings("ignore::pytest.PytestUnraisableExceptionWarning"),
+]
+
+
+app = FastAPI()
+
+
+@app.get("/stream-raw", response_class=StreamingResponse)
+async def stream_raw() -> AsyncIterable[str]:
+    """Async generator with no internal await - would hang without checkpoint."""
+    i = 0
+    while True:
+        yield f"item {i}\n"
+        i += 1
+
+
+@app.get("/stream-jsonl")
+async def stream_jsonl() -> AsyncIterable[int]:
+    """JSONL async generator with no internal await."""
+    i = 0
+    while True:
+        yield i
+        i += 1
+
+
+async def _run_asgi_and_cancel(app: FastAPI, path: str, timeout: float) -> bool:
+    """Call the ASGI app for *path* and cancel after *timeout* seconds.
+
+    Returns `True` if the cancellation was delivered (i.e. it did not hang).
+    """
+    chunks: list[bytes] = []
+
+    async def receive():  # type: ignore[no-untyped-def]
+        # Simulate a client that never disconnects, rely on cancellation
+        await anyio.sleep(float("inf"))
+        return {"type": "http.disconnect"}
+
+    async def send(message: dict) -> None:  # type: ignore[type-arg]
+        if message["type"] == "http.response.body":
+            chunks.append(message.get("body", b""))
+
+    scope = {
+        "type": "http",
+        "asgi": {"version": "3.0", "spec_version": "2.0"},
+        "http_version": "1.1",
+        "method": "GET",
+        "path": path,
+        "query_string": b"",
+        "root_path": "",
+        "headers": [],
+        "server": ("test", 80),
+    }
+
+    with anyio.move_on_after(timeout) as cancel_scope:
+        await app(scope, receive, send)  # type: ignore[arg-type]
+
+    # If we got here within the timeout the generator was cancellable.
+    # cancel_scope.cancelled_caught is True when move_on_after fired.
+    return cancel_scope.cancelled_caught or len(chunks) > 0
+
+
+async def test_raw_stream_cancellation() -> None:
+    """Raw streaming endpoint should be cancellable within a reasonable time."""
+    cancelled = await _run_asgi_and_cancel(app, "/stream-raw", timeout=3.0)
+    # The key assertion: we reached this line at all (didn't hang).
+    # cancelled will be True because the infinite generator was interrupted.
+    assert cancelled
+
+
+async def test_jsonl_stream_cancellation() -> None:
+    """JSONL streaming endpoint should be cancellable within a reasonable time."""
+    cancelled = await _run_asgi_and_cancel(app, "/stream-jsonl", timeout=3.0)
+    assert cancelled

tests/test_stream_json_validation_error.py

@@ -0,0 +1,40 @@
+from collections.abc import AsyncIterable, Iterable
+
+import pytest
+from fastapi import FastAPI
+from fastapi.exceptions import ResponseValidationError
+from fastapi.testclient import TestClient
+from pydantic import BaseModel
+
+
+class Item(BaseModel):
+    name: str
+    price: float
+
+
+app = FastAPI()
+
+
+@app.get("/items/stream-invalid")
+async def stream_items_invalid() -> AsyncIterable[Item]:
+    yield {"name": "valid", "price": 1.0}
+    yield {"name": "invalid", "price": "not-a-number"}
+
+
+@app.get("/items/stream-invalid-sync")
+def stream_items_invalid_sync() -> Iterable[Item]:
+    yield {"name": "valid", "price": 1.0}
+    yield {"name": "invalid", "price": "not-a-number"}
+
+
+client = TestClient(app)
+
+
+def test_stream_json_validation_error_async():
+    with pytest.raises(ResponseValidationError):
+        client.get("/items/stream-invalid")
+
+
+def test_stream_json_validation_error_sync():
+    with pytest.raises(ResponseValidationError):
+        client.get("/items/stream-invalid-sync")

tests/test_strict_content_type_app_level.py

@@ -0,0 +1,44 @@
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+app_default = FastAPI()
+
+
+@app_default.post("/items/")
+async def app_default_post(data: dict):
+    return data
+
+
+app_lax = FastAPI(strict_content_type=False)
+
+
+@app_lax.post("/items/")
+async def app_lax_post(data: dict):
+    return data
+
+
+client_default = TestClient(app_default)
+client_lax = TestClient(app_lax)
+
+
+def test_default_strict_rejects_no_content_type():
+    response = client_default.post("/items/", content='{"key": "value"}')
+    assert response.status_code == 422
+
+
+def test_default_strict_accepts_json_content_type():
+    response = client_default.post("/items/", json={"key": "value"})
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}
+
+
+def test_lax_accepts_no_content_type():
+    response = client_lax.post("/items/", content='{"key": "value"}')
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}
+
+
+def test_lax_accepts_json_content_type():
+    response = client_lax.post("/items/", json={"key": "value"})
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}

tests/test_strict_content_type_nested.py

@@ -0,0 +1,91 @@
+from fastapi import APIRouter, FastAPI
+from fastapi.testclient import TestClient
+
+# Lax app with nested routers, inner overrides to strict
+
+app_nested = FastAPI(strict_content_type=False)  # lax app
+outer_router = APIRouter(prefix="/outer")  # inherits lax from app
+inner_strict = APIRouter(prefix="/strict", strict_content_type=True)
+inner_default = APIRouter(prefix="/default")
+
+
+@inner_strict.post("/items/")
+async def inner_strict_post(data: dict):
+    return data
+
+
+@inner_default.post("/items/")
+async def inner_default_post(data: dict):
+    return data
+
+
+outer_router.include_router(inner_strict)
+outer_router.include_router(inner_default)
+app_nested.include_router(outer_router)
+
+client_nested = TestClient(app_nested)
+
+
+def test_strict_inner_on_lax_app_rejects_no_content_type():
+    response = client_nested.post("/outer/strict/items/", content='{"key": "value"}')
+    assert response.status_code == 422
+
+
+def test_default_inner_inherits_lax_from_app():
+    response = client_nested.post("/outer/default/items/", content='{"key": "value"}')
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}
+
+
+def test_strict_inner_accepts_json_content_type():
+    response = client_nested.post("/outer/strict/items/", json={"key": "value"})
+    assert response.status_code == 200
+
+
+def test_default_inner_accepts_json_content_type():
+    response = client_nested.post("/outer/default/items/", json={"key": "value"})
+    assert response.status_code == 200
+
+
+# Strict app -> lax outer router -> strict inner router
+
+app_mixed = FastAPI(strict_content_type=True)
+mixed_outer = APIRouter(prefix="/outer", strict_content_type=False)
+mixed_inner = APIRouter(prefix="/inner", strict_content_type=True)
+
+
+@mixed_outer.post("/items/")
+async def mixed_outer_post(data: dict):
+    return data
+
+
+@mixed_inner.post("/items/")
+async def mixed_inner_post(data: dict):
+    return data
+
+
+mixed_outer.include_router(mixed_inner)
+app_mixed.include_router(mixed_outer)
+
+client_mixed = TestClient(app_mixed)
+
+
+def test_lax_outer_on_strict_app_accepts_no_content_type():
+    response = client_mixed.post("/outer/items/", content='{"key": "value"}')
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}
+
+
+def test_strict_inner_on_lax_outer_rejects_no_content_type():
+    response = client_mixed.post("/outer/inner/items/", content='{"key": "value"}')
+    assert response.status_code == 422
+
+
+def test_lax_outer_accepts_json_content_type():
+    response = client_mixed.post("/outer/items/", json={"key": "value"})
+    assert response.status_code == 200
+
+
+def test_strict_inner_on_lax_outer_accepts_json_content_type():
+    response = client_mixed.post("/outer/inner/items/", json={"key": "value"})
+    assert response.status_code == 200

tests/test_strict_content_type_router_level.py

@@ -0,0 +1,61 @@
+from fastapi import APIRouter, FastAPI
+from fastapi.testclient import TestClient
+
+app = FastAPI()
+
+router_lax = APIRouter(prefix="/lax", strict_content_type=False)
+router_strict = APIRouter(prefix="/strict", strict_content_type=True)
+router_default = APIRouter(prefix="/default")
+
+
+@router_lax.post("/items/")
+async def router_lax_post(data: dict):
+    return data
+
+
+@router_strict.post("/items/")
+async def router_strict_post(data: dict):
+    return data
+
+
+@router_default.post("/items/")
+async def router_default_post(data: dict):
+    return data
+
+
+app.include_router(router_lax)
+app.include_router(router_strict)
+app.include_router(router_default)
+
+client = TestClient(app)
+
+
+def test_lax_router_on_strict_app_accepts_no_content_type():
+    response = client.post("/lax/items/", content='{"key": "value"}')
+    assert response.status_code == 200
+    assert response.json() == {"key": "value"}
+
+
+def test_strict_router_on_strict_app_rejects_no_content_type():
+    response = client.post("/strict/items/", content='{"key": "value"}')
+    assert response.status_code == 422
+
+
+def test_default_router_inherits_strict_from_app():
+    response = client.post("/default/items/", content='{"key": "value"}')
+    assert response.status_code == 422
+
+
+def test_lax_router_accepts_json_content_type():
+    response = client.post("/lax/items/", json={"key": "value"})
+    assert response.status_code == 200
+
+
+def test_strict_router_accepts_json_content_type():
+    response = client.post("/strict/items/", json={"key": "value"})
+    assert response.status_code == 200
+
+
+def test_default_router_accepts_json_content_type():
+    response = client.post("/default/items/", json={"key": "value"})
+    assert response.status_code == 200

tests/test_swagger_ui_escape.py

@@ -0,0 +1,37 @@
+from fastapi.openapi.docs import get_swagger_ui_html
+
+
+def test_init_oauth_html_chars_are_escaped():
+    xss_payload = "Evil</script><script>alert(1)</script>"
+    html = get_swagger_ui_html(
+        openapi_url="/openapi.json",
+        title="Test",
+        init_oauth={"appName": xss_payload},
+    )
+    body = html.body.decode()
+
+    assert "</script><script>" not in body
+    assert "\\u003c/script\\u003e\\u003cscript\\u003e" in body
+
+
+def test_swagger_ui_parameters_html_chars_are_escaped():
+    html = get_swagger_ui_html(
+        openapi_url="/openapi.json",
+        title="Test",
+        swagger_ui_parameters={"customKey": "<img src=x onerror=alert(1)>"},
+    )
+    body = html.body.decode()
+    assert "<img src=x onerror=alert(1)>" not in body
+    assert "\\u003cimg" in body
+
+
+def test_normal_init_oauth_still_works():
+    html = get_swagger_ui_html(
+        openapi_url="/openapi.json",
+        title="Test",
+        init_oauth={"clientId": "my-client", "appName": "My App"},
+    )
+    body = html.body.decode()
+    assert '"clientId": "my-client"' in body
+    assert '"appName": "My App"' in body
+    assert "ui.initOAuth" in body

tests/test_tutorial/test_additional_responses/test_tutorial002.py

@@ -6,7 +6,7 @@ import pytest
 from fastapi.testclient import TestClient
 from inline_snapshot import snapshot
 
-from tests.utils import needs_py310
+from tests.utils import needs_py310, workdir_lock
 
 
 @pytest.fixture(
@@ -29,6 +29,7 @@ def test_path_operation(client: TestClient):
     assert response.json() == {"id": "foo", "value": "there goes my hero"}
 
 
+@workdir_lock
 def test_path_operation_img(client: TestClient):
     shutil.copy("./docs/en/docs/img/favicon.png", "./image.png")
     response = client.get("/items/foo?img=1")

tests/test_tutorial/test_additional_responses/test_tutorial004.py

@@ -6,7 +6,7 @@ import pytest
 from fastapi.testclient import TestClient
 from inline_snapshot import snapshot
 
-from tests.utils import needs_py310
+from tests.utils import needs_py310, workdir_lock
 
 
 @pytest.fixture(
@@ -29,6 +29,7 @@ def test_path_operation(client: TestClient):
     assert response.json() == {"id": "foo", "value": "there goes my hero"}
 
 
+@workdir_lock
 def test_path_operation_img(client: TestClient):
     shutil.copy("./docs/en/docs/img/favicon.png", "./image.png")
     response = client.get("/items/foo?img=1")

tests/test_tutorial/test_background_tasks/test_tutorial001.py

@@ -4,10 +4,12 @@ from pathlib import Path
 from fastapi.testclient import TestClient
 
 from docs_src.background_tasks.tutorial001_py310 import app
+from tests.utils import workdir_lock
 
 client = TestClient(app)
 
 
+@workdir_lock
 def test():
     log = Path("log.txt")
     if log.is_file():

tests/test_tutorial/test_background_tasks/test_tutorial002.py

@@ -5,7 +5,7 @@ from pathlib import Path
 import pytest
 from fastapi.testclient import TestClient
 
-from ...utils import needs_py310
+from tests.utils import needs_py310, workdir_lock
 
 
 @pytest.fixture(
@@ -22,6 +22,7 @@ def get_client(request: pytest.FixtureRequest):
     return client
 
 
+@workdir_lock
 def test(client: TestClient):
     log = Path("log.txt")
     if log.is_file():

tests/test_tutorial/test_body/test_tutorial001.py

@@ -189,18 +189,12 @@ def test_geo_json(client: TestClient):
     assert response.status_code == 200, response.text
 
 
-def test_no_content_type_is_json(client: TestClient):
+def test_no_content_type_json(client: TestClient):
     response = client.post(
         "/items/",
         content='{"name": "Foo", "price": 50.5}',
     )
-    assert response.status_code == 200, response.text
+    assert response.status_code == 422, response.text
-    assert response.json() == {
-        "name": "Foo",
-        "description": None,
-        "price": 50.5,
-        "tax": None,
-    }
 
 
 def test_wrong_headers(client: TestClient):

tests/test_tutorial/test_custom_docs_ui/test_tutorial001.py

@@ -4,6 +4,8 @@ from pathlib import Path
 import pytest
 from fastapi.testclient import TestClient
 
+from tests.utils import workdir_lock
+
 
 @pytest.fixture(scope="module")
 def client():
@@ -17,6 +19,7 @@ def client():
     static_dir.rmdir()
 
 
+@workdir_lock
 def test_swagger_ui_html(client: TestClient):
     response = client.get("/docs")
     assert response.status_code == 200, response.text
@@ -24,18 +27,21 @@ def test_swagger_ui_html(client: TestClient):
     assert "https://unpkg.com/swagger-ui-dist@5/swagger-ui.css" in response.text
 
 
+@workdir_lock
 def test_swagger_ui_oauth2_redirect_html(client: TestClient):
     response = client.get("/docs/oauth2-redirect")
     assert response.status_code == 200, response.text
     assert "window.opener.swaggerUIRedirectOauth2" in response.text
 
 
+@workdir_lock
 def test_redoc_html(client: TestClient):
     response = client.get("/redoc")
     assert response.status_code == 200, response.text
     assert "https://unpkg.com/redoc@2/bundles/redoc.standalone.js" in response.text
 
 
+@workdir_lock
 def test_api(client: TestClient):
     response = client.get("/users/john")
     assert response.status_code == 200, response.text

tests/test_tutorial/test_custom_docs_ui/test_tutorial002.py

@@ -4,6 +4,8 @@ from pathlib import Path
 import pytest
 from fastapi.testclient import TestClient
 
+from tests.utils import workdir_lock
+
 
 @pytest.fixture(scope="module")
 def client():
@@ -17,6 +19,7 @@ def client():
     static_dir.rmdir()
 
 
+@workdir_lock
 def test_swagger_ui_html(client: TestClient):
     response = client.get("/docs")
     assert response.status_code == 200, response.text
@@ -24,18 +27,21 @@ def test_swagger_ui_html(client: TestClient):
     assert "/static/swagger-ui.css" in response.text
 
 
+@workdir_lock
 def test_swagger_ui_oauth2_redirect_html(client: TestClient):
     response = client.get("/docs/oauth2-redirect")
     assert response.status_code == 200, response.text
     assert "window.opener.swaggerUIRedirectOauth2" in response.text
 
 
+@workdir_lock
 def test_redoc_html(client: TestClient):
     response = client.get("/redoc")
     assert response.status_code == 200, response.text
     assert "/static/redoc.standalone.js" in response.text
 
 
+@workdir_lock
 def test_api(client: TestClient):
     response = client.get("/users/john")
     assert response.status_code == 200, response.text

tests/test_tutorial/test_custom_response/test_tutorial001.py

@@ -9,7 +9,6 @@ from inline_snapshot import snapshot
     name="client",
     params=[
         pytest.param("tutorial001_py310"),
-        pytest.param("tutorial010_py310"),
     ],
 )
 def get_client(request: pytest.FixtureRequest):
@@ -18,12 +17,14 @@ def get_client(request: pytest.FixtureRequest):
     return client
 
 
+@pytest.mark.filterwarnings("ignore::fastapi.exceptions.FastAPIDeprecationWarning")
 def test_get_custom_response(client: TestClient):
     response = client.get("/items/")
     assert response.status_code == 200, response.text
     assert response.json() == [{"item_id": "Foo"}]
 
 
+@pytest.mark.filterwarnings("ignore::fastapi.exceptions.FastAPIDeprecationWarning")
 def test_openapi_schema(client: TestClient):
     response = client.get("/openapi.json")
     assert response.status_code == 200, response.text

tests/test_tutorial/test_custom_response/test_tutorial001b.py

@@ -1,17 +1,25 @@
+import warnings
+
+import pytest
+from fastapi.exceptions import FastAPIDeprecationWarning
 from fastapi.testclient import TestClient
 from inline_snapshot import snapshot
 
-from docs_src.custom_response.tutorial001b_py310 import app
+with warnings.catch_warnings():
+    warnings.simplefilter("ignore", FastAPIDeprecationWarning)
+    from docs_src.custom_response.tutorial001b_py310 import app
 
 client = TestClient(app)
 
 
+@pytest.mark.filterwarnings("ignore::fastapi.exceptions.FastAPIDeprecationWarning")
 def test_get_custom_response():
     response = client.get("/items/")
     assert response.status_code == 200, response.text
     assert response.json() == [{"item_id": "Foo"}]
 
 
+@pytest.mark.filterwarnings("ignore::fastapi.exceptions.FastAPIDeprecationWarning")
 def test_openapi_schema():
     response = client.get("/openapi.json")
     assert response.status_code == 200, response.text

tests/test_tutorial/test_custom_response/test_tutorial010.py

@@ -0,0 +1,50 @@
+import importlib
+
+import pytest
+from fastapi.testclient import TestClient
+from inline_snapshot import snapshot
+
+
+@pytest.fixture(
+    name="client",
+    params=[
+        pytest.param("tutorial010_py310"),
+    ],
+)
+def get_client(request: pytest.FixtureRequest):
+    mod = importlib.import_module(f"docs_src.custom_response.{request.param}")
+    client = TestClient(mod.app)
+    return client
+
+
+def test_get_custom_response(client: TestClient):
+    response = client.get("/items/")
+    assert response.status_code == 200, response.text
+    assert response.text == snapshot("<h1>Items</h1><p>This is a list of items.</p>")
+
+
+def test_openapi_schema(client: TestClient):
+    response = client.get("/openapi.json")
+    assert response.status_code == 200, response.text
+    assert response.json() == snapshot(
+        {
+            "openapi": "3.1.0",
+            "info": {"title": "FastAPI", "version": "0.1.0"},
+            "paths": {
+                "/items/": {
+                    "get": {
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                                "content": {
+                                    "text/html": {"schema": {"type": "string"}}
+                                },
+                            }
+                        },
+                        "summary": "Read Items",
+                        "operationId": "read_items_items__get",
+                    }
+                }
+            },
+        }
+    )

tests/test_tutorial/test_events/test_tutorial002.py

@@ -3,6 +3,8 @@ from fastapi import FastAPI
 from fastapi.testclient import TestClient
 from inline_snapshot import snapshot
 
+from tests.utils import workdir_lock
+
 
 @pytest.fixture(name="app", scope="module")
 def get_app():
@@ -11,6 +13,7 @@ def get_app():
     yield app
 
 
+@workdir_lock
 def test_events(app: FastAPI):
     with TestClient(app) as client:
         response = client.get("/items/")
@@ -20,6 +23,7 @@ def test_events(app: FastAPI):
         assert "Application shutdown" in log.read()
 
 
+@workdir_lock
 def test_openapi_schema(app: FastAPI):
     with TestClient(app) as client:
         response = client.get("/openapi.json")

tests/test_tutorial/test_json_base64_bytes/test_tutorial001.py

@@ -0,0 +1,225 @@
+import importlib
+
+import pytest
+from fastapi.testclient import TestClient
+from inline_snapshot import snapshot
+
+from tests.utils import needs_py310
+
+
+@pytest.fixture(
+    name="client",
+    params=[pytest.param("tutorial001_py310", marks=needs_py310)],
+)
+def get_client(request: pytest.FixtureRequest):
+    mod = importlib.import_module(f"docs_src.json_base64_bytes.{request.param}")
+
+    client = TestClient(mod.app)
+    return client
+
+
+def test_post_data(client: TestClient):
+    response = client.post(
+        "/data",
+        json={
+            "description": "A file",
+            "data": "SGVsbG8sIFdvcmxkIQ==",
+        },
+    )
+    assert response.status_code == 200, response.text
+    assert response.json() == {"description": "A file", "content": "Hello, World!"}
+
+
+def test_get_data(client: TestClient):
+    response = client.get("/data")
+    assert response.status_code == 200, response.text
+    assert response.json() == {"description": "A plumbus", "data": "aGVsbG8="}
+
+
+def test_post_data_in_out(client: TestClient):
+    response = client.post(
+        "/data-in-out",
+        json={
+            "description": "A plumbus",
+            "data": "SGVsbG8sIFdvcmxkIQ==",
+        },
+    )
+    assert response.status_code == 200, response.text
+    assert response.json() == {
+        "description": "A plumbus",
+        "data": "SGVsbG8sIFdvcmxkIQ==",
+    }
+
+
+def test_openapi_schema(client: TestClient):
+    response = client.get("/openapi.json")
+    assert response.status_code == 200, response.text
+    assert response.json() == snapshot(
+        {
+            "openapi": "3.1.0",
+            "info": {"title": "FastAPI", "version": "0.1.0"},
+            "paths": {
+                "/data": {
+                    "get": {
+                        "summary": "Get Data",
+                        "operationId": "get_data_data_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                                "content": {
+                                    "application/json": {
+                                        "schema": {
+                                            "$ref": "#/components/schemas/DataOutput"
+                                        }
+                                    }
+                                },
+                            }
+                        },
+                    },
+                    "post": {
+                        "summary": "Post Data",
+                        "operationId": "post_data_data_post",
+                        "requestBody": {
+                            "content": {
+                                "application/json": {
+                                    "schema": {"$ref": "#/components/schemas/DataInput"}
+                                }
+                            },
+                            "required": True,
+                        },
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                                "content": {"application/json": {"schema": {}}},
+                            },
+                            "422": {
+                                "description": "Validation Error",
+                                "content": {
+                                    "application/json": {
+                                        "schema": {
+                                            "$ref": "#/components/schemas/HTTPValidationError"
+                                        }
+                                    }
+                                },
+                            },
+                        },
+                    },
+                },
+                "/data-in-out": {
+                    "post": {
+                        "summary": "Post Data In Out",
+                        "operationId": "post_data_in_out_data_in_out_post",
+                        "requestBody": {
+                            "content": {
+                                "application/json": {
+                                    "schema": {
+                                        "$ref": "#/components/schemas/DataInputOutput"
+                                    }
+                                }
+                            },
+                            "required": True,
+                        },
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                                "content": {
+                                    "application/json": {
+                                        "schema": {
+                                            "$ref": "#/components/schemas/DataInputOutput"
+                                        }
+                                    }
+                                },
+                            },
+                            "422": {
+                                "description": "Validation Error",
+                                "content": {
+                                    "application/json": {
+                                        "schema": {
+                                            "$ref": "#/components/schemas/HTTPValidationError"
+                                        }
+                                    }
+                                },
+                            },
+                        },
+                    }
+                },
+            },
+            "components": {
+                "schemas": {
+                    "DataInput": {
+                        "properties": {
+                            "description": {"type": "string", "title": "Description"},
+                            "data": {
+                                "type": "string",
+                                "contentEncoding": "base64",
+                                "contentMediaType": "application/octet-stream",
+                                "title": "Data",
+                            },
+                        },
+                        "type": "object",
+                        "required": ["description", "data"],
+                        "title": "DataInput",
+                    },
+                    "DataInputOutput": {
+                        "properties": {
+                            "description": {"type": "string", "title": "Description"},
+                            "data": {
+                                "type": "string",
+                                "contentEncoding": "base64",
+                                "contentMediaType": "application/octet-stream",
+                                "title": "Data",
+                            },
+                        },
+                        "type": "object",
+                        "required": ["description", "data"],
+                        "title": "DataInputOutput",
+                    },
+                    "DataOutput": {
+                        "properties": {
+                            "description": {"type": "string", "title": "Description"},
+                            "data": {
+                                "type": "string",
+                                "contentEncoding": "base64",
+                                "contentMediaType": "application/octet-stream",
+                                "title": "Data",
+                            },
+                        },
+                        "type": "object",
+                        "required": ["description", "data"],
+                        "title": "DataOutput",
+                    },
+                    "HTTPValidationError": {
+                        "properties": {
+                            "detail": {
+                                "items": {
+                                    "$ref": "#/components/schemas/ValidationError"
+                                },
+                                "type": "array",
+                                "title": "Detail",
+                            }
+                        },
+                        "type": "object",
+                        "title": "HTTPValidationError",
+                    },
+                    "ValidationError": {
+                        "properties": {
+                            "ctx": {"title": "Context", "type": "object"},
+                            "input": {"title": "Input"},
+                            "loc": {
+                                "items": {
+                                    "anyOf": [{"type": "string"}, {"type": "integer"}]
+                                },
+                                "type": "array",
+                                "title": "Location",
+                            },
+                            "msg": {"type": "string", "title": "Message"},
+                            "type": {"type": "string", "title": "Error Type"},
+                        },
+                        "type": "object",
+                        "required": ["loc", "msg", "type"],
+                        "title": "ValidationError",
+                    },
+                }
+            },
+        }
+    )

tests/test_tutorial/test_request_files/test_tutorial001.py

@@ -162,8 +162,8 @@ def test_openapi_schema(client: TestClient):
                         "properties": {
                             "file": {
                                 "title": "File",
+                                "contentMediaType": "application/octet-stream",
                                 "type": "string",
-                                "format": "binary",
                             }
                         },
                     },
@@ -175,7 +175,7 @@ def test_openapi_schema(client: TestClient):
                             "file": {
                                 "title": "File",
                                 "type": "string",
-                                "format": "binary",
+                                "contentMediaType": "application/octet-stream",
                             }
                         },
                     },

tests/test_tutorial/test_request_files/test_tutorial001_02.py

@@ -134,7 +134,10 @@ def test_openapi_schema(client: TestClient):
                             "file": {
                                 "title": "File",
                                 "anyOf": [
-                                    {"type": "string", "format": "binary"},
+                                    {
+                                        "type": "string",
+                                        "contentMediaType": "application/octet-stream",
+                                    },
                                     {"type": "null"},
                                 ],
                             }
@@ -147,7 +150,10 @@ def test_openapi_schema(client: TestClient):
                             "file": {
                                 "title": "File",
                                 "anyOf": [
-                                    {"type": "string", "format": "binary"},
+                                    {
+                                        "type": "string",
+                                        "contentMediaType": "application/octet-stream",
+                                    },
                                     {"type": "null"},
                                 ],
                             }

tests/test_tutorial/test_request_files/test_tutorial001_03.py

@@ -123,7 +123,7 @@ def test_openapi_schema(client: TestClient):
                                 "title": "File",
                                 "type": "string",
                                 "description": "A file read as bytes",
-                                "format": "binary",
+                                "contentMediaType": "application/octet-stream",
                             }
                         },
                     },
@@ -134,9 +134,9 @@ def test_openapi_schema(client: TestClient):
                         "properties": {
                             "file": {
                                 "title": "File",
+                                "contentMediaType": "application/octet-stream",
                                 "type": "string",
                                 "description": "A file read as UploadFile",
-                                "format": "binary",
                             }
                         },
                     },

tests/test_tutorial/test_request_files/test_tutorial002.py

@@ -195,7 +195,10 @@ def test_openapi_schema(client: TestClient):
                             "files": {
                                 "title": "Files",
                                 "type": "array",
-                                "items": {"type": "string", "format": "binary"},
+                                "items": {
+                                    "type": "string",
+                                    "contentMediaType": "application/octet-stream",
+                                },
                             }
                         },
                     },
@@ -207,7 +210,10 @@ def test_openapi_schema(client: TestClient):
                             "files": {
                                 "title": "Files",
                                 "type": "array",
-                                "items": {"type": "string", "format": "binary"},
+                                "items": {
+                                    "type": "string",
+                                    "contentMediaType": "application/octet-stream",
+                                },
                             }
                         },
                     },

tests/test_tutorial/test_request_files/test_tutorial003.py

@@ -165,7 +165,10 @@ def test_openapi_schema(client: TestClient):
                             "files": {
                                 "title": "Files",
                                 "type": "array",
-                                "items": {"type": "string", "format": "binary"},
+                                "items": {
+                                    "type": "string",
+                                    "contentMediaType": "application/octet-stream",
+                                },
                                 "description": "Multiple files as bytes",
                             }
                         },
@@ -178,7 +181,10 @@ def test_openapi_schema(client: TestClient):
                             "files": {
                                 "title": "Files",
                                 "type": "array",
-                                "items": {"type": "string", "format": "binary"},
+                                "items": {
+                                    "type": "string",
+                                    "contentMediaType": "application/octet-stream",
+                                },
                                 "description": "Multiple files as UploadFile",
                             }
                         },

tests/test_tutorial/test_request_forms_and_files/test_tutorial001.py

@@ -198,12 +198,12 @@ def test_openapi_schema(client: TestClient):
                             "file": {
                                 "title": "File",
                                 "type": "string",
-                                "format": "binary",
+                                "contentMediaType": "application/octet-stream",
                             },
                             "fileb": {
                                 "title": "Fileb",
+                                "contentMediaType": "application/octet-stream",
                                 "type": "string",
-                                "format": "binary",
                             },
                             "token": {"title": "Token", "type": "string"},
                         },

tests/test_tutorial/test_settings/test_app01.py

@@ -22,7 +22,7 @@ def get_mod_name(request: pytest.FixtureRequest):
 @pytest.fixture(name="client")
 def get_test_client(mod_name: str, monkeypatch: MonkeyPatch) -> TestClient:
     if mod_name in sys.modules:
-        del sys.modules[mod_name]
+        del sys.modules[mod_name]  # pragma: no cover
     monkeypatch.setenv("ADMIN_EMAIL", "admin@example.com")
     main_mod = importlib.import_module(mod_name)
     return TestClient(main_mod.app)

tests/test_tutorial/test_static_files/test_tutorial001.py

@@ -5,6 +5,8 @@ import pytest
 from fastapi.testclient import TestClient
 from inline_snapshot import snapshot
 
+from tests.utils import workdir_lock
+
 
 @pytest.fixture(scope="module")
 def client():
@@ -20,17 +22,20 @@ def client():
     static_dir.rmdir()
 
 
+@workdir_lock
 def test_static_files(client: TestClient):
     response = client.get("/static/sample.txt")
     assert response.status_code == 200, response.text
     assert response.text == "This is a sample static file."
 
 
+@workdir_lock
 def test_static_files_not_found(client: TestClient):
     response = client.get("/static/non_existent_file.txt")
     assert response.status_code == 404, response.text
 
 
+@workdir_lock
 def test_openapi_schema(client: TestClient):
     response = client.get("/openapi.json")
     assert response.status_code == 200, response.text

tests/test_tutorial/test_stream_data/test_tutorial001.py

@@ -0,0 +1,154 @@
+import importlib
+
+import pytest
+from fastapi.testclient import TestClient
+from inline_snapshot import snapshot
+
+
+@pytest.fixture(
+    name="client",
+    params=[
+        pytest.param("tutorial001_py310"),
+    ],
+)
+def get_client(request: pytest.FixtureRequest):
+    mod = importlib.import_module(f"docs_src.stream_data.{request.param}")
+
+    client = TestClient(mod.app)
+    return client
+
+
+expected_text = (
+    ""
+    "Rick: (stumbles in drunkenly, and turns on the lights)"
+    " Morty! You gotta come on. You got--... you gotta come with me."
+    "Morty: (rubs his eyes) What, Rick? What's going on?"
+    "Rick: I got a surprise for you, Morty."
+    "Morty: It's the middle of the night. What are you talking about?"
+    "Rick: (spills alcohol on Morty's bed) Come on, I got a surprise for you."
+    " (drags Morty by the ankle) Come on, hurry up."
+    " (pulls Morty out of his bed and into the hall)"
+    "Morty: Ow! Ow! You're tugging me too hard!"
+    "Rick: We gotta go, gotta get outta here, come on."
+    " Got a surprise for you Morty."
+)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        "/story/stream",
+        "/story/stream-no-async",
+        "/story/stream-no-annotation",
+        "/story/stream-no-async-no-annotation",
+        "/story/stream-bytes",
+        "/story/stream-no-async-bytes",
+        "/story/stream-no-annotation-bytes",
+        "/story/stream-no-async-no-annotation-bytes",
+    ],
+)
+def test_stream_story(client: TestClient, path: str):
+    response = client.get(path)
+    assert response.status_code == 200, response.text
+    assert response.text == expected_text
+
+
+def test_openapi_schema(client: TestClient):
+    response = client.get("/openapi.json")
+    assert response.status_code == 200, response.text
+    assert response.json() == snapshot(
+        {
+            "openapi": "3.1.0",
+            "info": {"title": "FastAPI", "version": "0.1.0"},
+            "paths": {
+                "/story/stream": {
+                    "get": {
+                        "summary": "Stream Story",
+                        "operationId": "stream_story_story_stream_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-async": {
+                    "get": {
+                        "summary": "Stream Story No Async",
+                        "operationId": "stream_story_no_async_story_stream_no_async_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-annotation": {
+                    "get": {
+                        "summary": "Stream Story No Annotation",
+                        "operationId": "stream_story_no_annotation_story_stream_no_annotation_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-async-no-annotation": {
+                    "get": {
+                        "summary": "Stream Story No Async No Annotation",
+                        "operationId": "stream_story_no_async_no_annotation_story_stream_no_async_no_annotation_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-bytes": {
+                    "get": {
+                        "summary": "Stream Story Bytes",
+                        "operationId": "stream_story_bytes_story_stream_bytes_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-async-bytes": {
+                    "get": {
+                        "summary": "Stream Story No Async Bytes",
+                        "operationId": "stream_story_no_async_bytes_story_stream_no_async_bytes_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-annotation-bytes": {
+                    "get": {
+                        "summary": "Stream Story No Annotation Bytes",
+                        "operationId": "stream_story_no_annotation_bytes_story_stream_no_annotation_bytes_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+                "/story/stream-no-async-no-annotation-bytes": {
+                    "get": {
+                        "summary": "Stream Story No Async No Annotation Bytes",
+                        "operationId": "stream_story_no_async_no_annotation_bytes_story_stream_no_async_no_annotation_bytes_get",
+                        "responses": {
+                            "200": {
+                                "description": "Successful Response",
+                            }
+                        },
+                    }
+                },
+            },
+        }
+    )