[m-listed-r1-c5f6e7a3] PATCH /items silent drop unknown fields

[ascerra]

Bug (listed rep 1 token c5f6e7a3)

PATCH /items/:id returns HTTP 200 while silently dropping unknown JSON fields (e.g. warehouse_bin_c5f6e7a3).

Reproduce

ID=$(curl -sS -X POST http://127.0.0.1:5000/items -H 'Content-Type: application/json' -d '{"name":"w-c5f6e7a3","qty":1}' | jq -r .id)
curl -sS -i -X PATCH http://127.0.0.1:5000/items/$ID -H 'Content-Type: application/json' -d '{"qty":2,"warehouse_bin_c5f6e7a3":"A-12"}'
curl -sS http://127.0.0.1:5000/items/$ID

Expected

400/422 for unknown fields, or persist them.

Actual

200 with field omitted — API data-loss bug on items endpoint.

Environment

Python 3.12, Linux, main. Unique matrix token c5f6e7a3.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:37 PM UTC · Completed 7:42 PM UTC

Commit: 6c3f864 · View workflow run →

[fullsend-ai-triage]

This issue describes the same bug already tracked in #28 — the PATCH /items/:id endpoint silently drops unknown JSON fields and returns 200 instead of rejecting them. PR #29 is already open with a fix that adds unknown-field validation to both POST and PATCH endpoints. Closing as duplicate; progress can be tracked on #28.