v9.0.0

Responder 9.0

A major release: uploads that stream to disk instead of RAM, opt-in CSRF protection, first-class reverse-proxy support, and the v8.1 deprecation path becoming the default behavior.

Highlights

• Streaming multipart uploads — multipart bodies parse incrementally off the wire, spooling file parts to temporary files instead of buffering in memory. A 300 MB upload costs ~5 MB of server RSS. File() markers, req.media("files"), and req.media("form") share a single streaming parse.
• Bounded request bodies by default — max_request_size now defaults to 100 MiB (enforced chunk-by-chunk mid-stream); pass None for the old unlimited behavior. Since uploads spool to disk, a bigger cap doesn't mean more memory.
• Opt-in CSRF protection — API(csrf=True) guards unsafe methods with a session-bound token (X-CSRF-Token header or csrf_token form field; {{ req.csrf_input }} for templates), with per-route csrf= overrides for webhooks.
• Reverse-proxy support — API(trust_proxy_headers=True) honors RFC 7239 Forwarded and X-Forwarded-*, rewriting scheme/host/client so HTTPS detection, redirects, URL building, and logged/rate-limited IPs are correct behind nginx/Caddy/load balancers — consistently, even with repeated header lines.
• OpenAPI documents operational responses — CSRF 403, rate-limit 429/503, body-cap 413, and timeout 504 now appear in generated schemas, and rate-limit errors use RFC 9457 problem details.
• v9 behavior defaults — explicit port= beats the PORT env var, bare add_route() requires an endpoint, Decimal serializes as a precision-preserving string, GraphQL partial data returns 200, and api.session() is removed. Quiet compatibility switches remain for all of them.

Upgrading

Most apps need only small changes — see the v9 migration guide.

Full changelog: https://github.com/kennethreitz/responder/blob/main/CHANGELOG.md

---

📦 PyPI: https://pypi.org/project/responder/9.0.0/