pypi / starlette
starlette
What changed in starlette 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
8 breaking8 new APIs and options1 performance4 behavior and defaults23 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initstarlette 144 changes
Breaking changes 8
Percent-encode
?,#,\and a leading//in the request path when buildingrequest.url.TestClient response bodies are streamed, so client.stream returns before the application finishes; closing an unfinished streamed response cancels the application.
By default, excludes native gRPC media types from compression.
Requires Python 3.11 or later; Python 3.10 is no longer supported.
Requires anyio>=4.0.0,<5, dropping support for AnyIO 3.
Background tasks now run only after the response is sent.
Invalid multipart parser input now returns 400.
Disconnected WebSocket operations now raise WebSocketDisconnected, a RuntimeError subclass.
New APIs and options 8
Adds a method to send HTTP 103 Early Hints through the ASGI http.response.early_hint extension.
Adds experimental HTTP server tracing with URL exclusions and custom tracer providers; its API and emitted telemetry may change in minor releases without a deprecation period.
Supports the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation.
Adds the partitioned option on Python 3.14 and later.
TestClient captures HTTP response trailers and exposes them through the response extensions mapping.
Exposes the matched route through the request scope.
Supports partitioned cookies in session middleware.
Implements identity on SimpleUser and UnauthenticatedUser.
Performance 1
ServerErrorMiddleware offloads debug traceback rendering to a worker thread.
Behavior and default changes 4
Host names are matched case-insensitively.
Sends http.response.start immediately for responses with an existing Content-Encoding, status 206, or an excluded content type, rather than waiting for the first body chunk.
Allows non-standard status codes without an explicit detail.
TrustedHostMiddleware and TestClient support IPv6 hosts.
Fixes and other changes 23
Use the byte length for
Content-Lengthwhen the response body is a typed or multidimensionalmemoryview.Host routing matches host names case-insensitively.
Include
HEADin theAllowheader of 405 responses whenGETis defined.Preserve every existing
Varyheader; this method is used byGZipMiddlewareandSessionMiddleware.Percent-encode
\and a leading//inurl_path_for.Stops transfers when the client disconnects.
Preserves response trailers when the middleware handles a response.
Stops a multipart range response when the file ends before a range is complete, instead of looping forever.
Ignores Range when If-Range contains a weak ETag.
Closes generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware.
Adds Vary: Cookie when removing an existing key.
Emits Max-Age=0 on the session cookie when max_age=0.
Includes Allow: GET, HEAD in 405 responses.
Brackets IPv6 hostnames in replacement URLs.
Normal CORS responses include Vary: Origin, and preflight responses vary by all request headers that affect them.
Configuration annotations accept Collection[str], including sets and frozensets.
Range headers are ignored when the response status is not 200, preserving its status and full body.
Malformed Host headers and IPv6 authorities are handled consistently across URL construction, host routing, and redirect middleware.
Adds support for Python 3.15.
Session mutations made with popitem() and |= are now persisted.
Handles a standalone If-None-Match: * header.
Rejects WebSocket requests without raising an assertion error.
Handles empty and absent payloads.