pypi / litestar
litestar
What changed in litestar 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.
5 security2 new APIs and options8 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initlitestar 215 changes
Security 5
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
Litestar has HTML Injection Through its CSRF Token
Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns
Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins
Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
New APIs and options 2
Route reverse can now take handlers.
Added support for typing.ReadOnly in TypedDict schemas.
Fixes and other changes 8
Improved the typing for Accept.best_match.
Fixed serialization support for Pydantic's AwareDatetime.
Stopped checking for Path in the default deserializer.
Fixed KeyError swallowing in the default serializer.
Fixed passing guards to the underlying websocket handler.
Added support for Python 3.14.
Added sniffio as a dependency.
Fixed required-field handling for TypedDict on Python 3.8.