[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
starlette (changelog)	>=0.52.1,<1.0.0 → >=1.10.0,<1.11.0

---

Release Notes

Kludex/starlette (starlette)

v1.10.0: Version 1.10.0

Compare Source

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#​3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#​3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#​3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#​3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#​3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#​3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#​3665, #​3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#​3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#​3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#​3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#​3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#​3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#​3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

v1.9.0: Version 1.9.0

Compare Source

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #​3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #​3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #​3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #​3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #​3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #​3675.

Full changelog: 1.8.0...1.9.0

v1.8.0: Version 1.8.0

Compare Source

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #​3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #​3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #​3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #​3631.
• Resolve the multipart charset once per request instead of once per field #​3618.

Fixed

• Preserve response trailers through GZipMiddleware #​3565.
• Stop FileResponse transfers when the client disconnects #​3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #​3583.
• Ignore Range when If-Range contains a weak ETag #​3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #​3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #​3628.
• Add Vary: Cookie when Session.pop() removes an existing key #​3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #​3651.
• Bracket IPv6 hostnames in URL.replace() #​3617.

Full changelog: 1.7.0...1.8.0

v1.7.0: Version 1.7.0

Compare Source

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING]
OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #​3438, #​3463, and #​3520.
• Expose the matched route through scope["route"] #​3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #​3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #​3563.
• Support partitioned cookies in SessionMiddleware #​3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #​3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #​3471.
• Support Python 3.15 #​3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #​3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #​2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #​3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #​3476.
• Return 400 for invalid multipart parser input #​3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #​3516 and #​3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #​3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #​3568.
• Handle standalone If-None-Match: * in StaticFiles #​3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #​3532.
• Persist session mutations made with popitem() and |= #​3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #​3372.
• Implement identity on SimpleUser and UnauthenticatedUser #​3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #​3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #​3498 and #​3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #​2858.

Full changelog: 1.6.0...1.7.0

v1.6.0: Version 1.6.0

Compare Source

What's Changed

• Add max_body_size to Starlette and route classes by @​Kludex in #​3431
• Expose http.response.debug info via response extensions by @​y2kbugger in #​3130

New Contributors

• @​y2kbugger made their first contribution in #​3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

v1.5.1: Version 1.5.1

Compare Source

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @​nikolauspschuetz in encode#3389
• Limit FileResponse to 100 ranges by @​Kludex in encode#3430

Full Changelog: Kludex/starlette@1.5.0...1.5.1

v1.5.0: Version 1.5.0

Compare Source

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @​Kludex in encode#3418
• Flush GZip output for each streamed chunk by @​Kludex in encode#3419
• Skip compression of partial responses in GZipMiddleware by @​Kludex in encode#3420
• Expand default excluded content types in GZipMiddleware by @​Kludex in encode#3421

Full Changelog: Kludex/starlette@1.4.1...1.5.0

v1.4.1: Version 1.4.1

Compare Source

What's Changed

• Default thread_minimum_size in GZipResponder by @​Kludex in #​3415

Full Changelog: Kludex/starlette@1.4.0...1.4.1

v1.4.0: Version 1.4.0

Compare Source

What's Changed

• Lazily allocate GZipMiddleware compression resources by @​Kludex in #​3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @​Kludex in #​3411
• Offload large GZip compression by @​Kludex in #​3410

New Contributors

• @​benberryallwood made their first contribution in #​3334
• @​lkk7 made their first contribution in #​3359

Full Changelog: Kludex/starlette@1.3.1...1.4.0

v1.3.1: Version 1.3.1

Compare Source

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @​Kludex in #​3119
• Enforce max_fields and max_part_size in FormParser by @​Kludex in #​3329
• Enforce FormParser limits in parser callbacks by @​Kludex in #​3331

Full Changelog: Kludex/starlette@1.3.0...1.3.1

v1.3.0: Version 1.3.0

Compare Source

What's Changed

• Clamp oversized suffix ranges in FileResponse by @​jiyujie2006 in #​3307
• Catch OSError alongside MultiPartException when closing temp files by @​N3XT3R1337 in #​3191
• Add httpx2 to the full extra by @​Kludex in #​3323
• Adjust testclient typing and warnings by @​waketzheng in #​3322
• Fix IndexError in URL.replace() on a URL with no authority by @​LeSingh1 in #​3317
• Annotate URLPath protocol parameter with Literal by @​Chang-LeHung in #​3285
• avoid collapsing exception groups from user code by @​graingert in #​2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @​gnosyslambda in #​3193
• Build request.url from structured components by @​Kludex in #​3326

New Contributors

• @​jiyujie2006 made their first contribution in #​3307
• @​N3XT3R1337 made their first contribution in #​3191
• @​leestana01 made their first contribution in #​3319
• @​LeSingh1 made their first contribution in #​3317
• @​EmmanuelNiyonshuti made their first contribution in #​3204
• @​Chang-LeHung made their first contribution in #​3285
• @​gnosyslambda made their first contribution in #​3193

Full Changelog: Kludex/starlette@1.2.1...1.3.0

v1.2.1: Version 1.2.1

Compare Source

What's Changed

• Use httpx2 for type checking in the testclient module by @​leifwar in #​3304
• Add assert error for requires() when request param is not Request type by @​KeeganOP in #​3298

New Contributors

• @​leifwar made their first contribution in #​3304
• @​diskeu made their first contribution in #​3243
• @​KeeganOP made their first contribution in #​3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

v1.2.0: Version 1.2.0

Compare Source

What's Changed

• Support httpx2 in the test client by @​Kludex in #​3291

Full Changelog: Kludex/starlette@1.1.0...1.2.0

v1.1.0: Version 1.1.0

Compare Source

What's Changed

• Use "application/octet-stream" as the FileResponse media type fallback by @​ATOM00blue in #​3283
• Only dispatch standard HTTP verbs in HTTPEndpoint by @​Kludex in #​3286
• Reject absolute paths in StaticFiles.lookup_path by @​Kludex in #​3287

New Contributors

• @​ATOM00blue made their first contribution in #​3283

Full Changelog: Kludex/starlette@1.0.1...1.1.0

v1.0.1: Version 1.0.1

Compare Source

What's Changed

• Ignore malformed Host header when constructing request.url by @​Kludex in #​3279

Full Changelog: Kludex/starlette@1.0.0...1.0.1

v1.0.0: Version 1.0.0

Compare Source

Starlette 1.0 is here! 🎉

After nearly eight years since its creation, Starlette has reached its first stable release.

A special thank you to @​lovelydinosaur, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏

Thank you to @​adriangb, @​graingert, @​agronholm, @​florimondmanca, @​aminalaee, @​tiangolo, @​alex-oleshkevich, @​abersheeran, and @​uSpike for helping make Starlette what it is today. And to all my sponsors - especially @​tiangolo, @​huggingface, and @​elevenlabs - thank you for your support!

Thank you to all 290+ contributors who have shaped Starlette over the years! ❤️

Read more on the blog post.

Check out the full release notes at https://www.starlette.io/release-notes/#​100-march-22-2026

---

Full Changelog: Kludex/starlette@1.0.0rc1...1.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.