Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
• Resolve the multipart charset once per request instead of once per field #3618.

Fixed

• Preserve response trailers through GZipMiddleware #3565.
• Stop FileResponse transfers when the client disconnects #3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
• Ignore Range when If-Range contains a weak ETag #3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
• Add Vary: Cookie when Session.pop() removes an existing key #3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
• Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

Warning

OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Version 1.6.0

What's Changed

• Add max_body_size to Starlette and route classes by @Kludex in #3431
• Expose http.response.debug info via response extensions by @y2kbugger in #3130

New Contributors

• @y2kbugger made their first contribution in #3130

Full Changelog: 1.5.1...1.6.0

Version 1.5.1

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @nikolauspschuetz in #3389
• Limit FileResponse to 100 ranges by @Kludex in #3430

Full Changelog: 1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @Kludex in #3418
• Flush GZip output for each streamed chunk by @Kludex in #3419
• Skip compression of partial responses in GZipMiddleware by @Kludex in #3420
• Expand default excluded content types in GZipMiddleware by @Kludex in #3421

Full Changelog: 1.4.1...1.5.0

Version 1.4.1

What's Changed

• Default thread_minimum_size in GZipResponder by @Kludex in #3415

Full Changelog: 1.4.0...1.4.1

Version 1.4.0

What's Changed

• Lazily allocate GZipMiddleware compression resources by @Kludex in #3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @Kludex in #3411
• Offload large GZip compression by @Kludex in #3410

New Contributors

• @benberryallwood made their first contribution in #3334
• @lkk7 made their first contribution in #3359

Full Changelog: 1.3.1...1.4.0

Version 1.3.1

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @Kludex in #3119
• Enforce max_fields and max_part_size in FormParser by @Kludex in #3329
• Enforce FormParser limits in parser callbacks by @Kludex in #3331

Full Changelog: 1.3.0...1.3.1

Version 1.3.0

What's Changed

• Clamp oversized suffix ranges in FileResponse by @jiyujie2006 in #3307
• Catch OSError alongside MultiPartException when closing temp files by @N3XT3R1337 in #3191
• Add httpx2 to the full extra by @Kludex in #3323
• Adjust testclient typing and warnings by @waketzheng in #3322
• Fix IndexError in URL.replace() on a URL with no authority by @LeSingh1 in #3317
• Annotate URLPath protocol parameter with Literal by @Chang-LeHung in #3285
• avoid collapsing exception groups from user code by @graingert in #2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @gnosyslambda in #3193
• Build request.url from structured components by @Kludex in #3326

New Contributors

• @jiyujie2006 made their first contribution in #3307
• @N3XT3R1337 made their first contribution in #3191
• @leestana01 made their first contribution in #3319
• @LeSingh1 made their first contribution in #3317
• @EmmanuelNiyonshuti made their first contribution in #3204
• @Chang-LeHung made their first contribution in #3285
• @gnosyslambda made their first contribution in #3193

Full Changelog: 1.2.1...1.3.0