The FastAPI project released version 0.148.0 on GitHub on 19 October 2026. Its notes list one item, a bug fix by @tiangolo (PR #16527) to how defaults work. A default is the value used when a caller leaves a field out. For omitted Query, Header, Cookie and Form parameters and for model fields, that value no longer counts as user input.
Validation now skips defaults unless validate_default=True is set, on a model field through Field or on a parameter such as Query. Body now honors that flag too. In parameter models, a default no longer makes a field count as set, so exclude_unset dumps drop it. Default factories run once, and errors stop listing injected defaults as input. A missing boolean form field still becomes False and still counts as set. The notes do not say what bug prompted this or which earlier versions differed.
Our analysis, not the notes: a default is now treated as trusted developer data, not untrusted caller input. Illustration: a validator that cleans or rejects a value would no longer run when the caller omits it. Engineering leads can ask which validators must run on omitted values, whether code relies on exclude_unset output, and whether tests cover requests that omit parameters.