[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
starlette (changelog)	~=1.7.0 → ~=1.10.0

---

Release Notes

Kludex/starlette (starlette)

v1.10.0: Version 1.10.0

Compare Source

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#​3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#​3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#​3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#​3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#​3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#​3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#​3665, #​3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#​3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#​3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#​3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#​3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#​3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#​3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

v1.9.0: Version 1.9.0

Compare Source

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #​3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #​3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #​3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #​3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #​3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #​3675.

Full changelog: 1.8.0...1.9.0

v1.8.0: Version 1.8.0

Compare Source

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #​3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #​3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #​3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #​3631.
• Resolve the multipart charset once per request instead of once per field #​3618.

Fixed

• Preserve response trailers through GZipMiddleware #​3565.
• Stop FileResponse transfers when the client disconnects #​3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #​3583.
• Ignore Range when If-Range contains a weak ETag #​3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #​3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #​3628.
• Add Vary: Cookie when Session.pop() removes an existing key #​3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #​3651.
• Bracket IPv6 hostnames in URL.replace() #​3617.

Full changelog: 1.7.0...1.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6:00am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.