feat: bump starlette dependency to 1.x

[pgrayy]

Description

Bumps dependencies in the [a2a] optional group:

• starlette: >=0.46.2,<1.0.0 → >=1.0.0,<2.0.0
• fastapi: >=0.115.12,<1.0.0 → >=0.133.0,<1.0.0 (first version that allows starlette 1.0)

Starlette 1.0 (released March 2026) removed long-deprecated APIs (on_startup/on_shutdown parameters, decorator-based routes). The SDK does not use any of those APIs. Our starlette usage is limited to:

• Starlette() bare construction and .mount() in A2AServer.to_starlette_app()
• Starlette(routes=[Mount(...)], lifespan=...) in the MCP integration test server
• TestClient in unit tests

Our FastAPI usage is just FastAPI() constructor and .mount() in to_fastapi_app(), which is unchanged across the version range.

All of these work unchanged on starlette 1.0 and fastapi 0.133+.

The a2a-sdk 0.3.x declares starlette with no version bound (Requires-Dist: starlette; extra == 'http-server'), so there is no resolver conflict. You can verify this in the 0.3.25 wheel metadata on PyPI by inspecting the METADATA file inside the wheel:

unzip -p a2a_sdk-0.3.25-py3-none-any.whl '*.dist-info/METADATA' | grep starlette

The fastapi floor bump is required because fastapi<0.133.0 pins starlette<1.0.0, making the two constraints unsatisfiable together. FastAPI 0.133.0 is the first release that drops the starlette upper bound.

Related Issues

N/A

Documentation PR

N/A

Type of Change

Breaking change

The [a2a] extra now requires starlette 1.0+ and fastapi 0.133.0+. Users who pin older versions will need to update. Since the [a2a] feature is experimental, this is expected. In practice, pip install strands-agents[a2a] resolves to the latest versions in the range, so this only affects users who explicitly constrain these packages below the new floor.

Testing

• All 149 A2A unit tests pass

• All 142 MCP unit tests pass

• All A2A integration tests pass (uvicorn serving starlette 1.0 app with real HTTP calls)

• Targeted compatibility script exercising every starlette API used in the SDK

• I ran hatch run prepare

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Assessment: Comment

Clean, well-scoped change with a thorough PR description. One dependency consistency issue to address: the fastapi>=0.115.12 lower bound is now unreachable because those versions cap starlette below 1.0. Bumping fastapi's lower bound to >=0.133.0 would make the dependency declarations self-consistent and accurate.

[github-actions]

Assessment: Approve

The previous feedback has been addressed — the fastapi lower bound is now correctly set to >=0.133.0. The dependency declarations are self-consistent, all starlette/fastapi APIs used in the SDK are stable and unchanged in the new version range, and the PR description clearly documents the rationale and breaking change scope. LGTM.