Update dependency starlette to ~=0.52.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
starlette (changelog)	~=0.35.1 → ~=0.52.1

---

Release Notes

Kludex/starlette (starlette)

v0.52.1: Version 0.52.1

Compare Source

What's Changed

• Only use typing_extensions in older Python versions by @​Kludex in #​3109

---

Full Changelog: Kludex/starlette@0.52.0...0.52.1

v0.52.0: Version 0.52.0

Compare Source

In this release, State can be accessed using dictionary-style syntax for improved type safety (#​3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict

import httpx

from starlette.applications import Starlette
from starlette.requests import Request

class State(TypedDict):
    http_client: httpx.AsyncClient

@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
    async with httpx.AsyncClient() as client:
        yield {"http_client": client}

async def homepage(request: Request[State]):
    client = request.state["http_client"]
    # If you run the below line with mypy or pyright, it will reveal the correct type.
    reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

---

Full Changelog: Kludex/starlette@0.51.0...0.52.0

v0.51.0: Version 0.51.0

Compare Source

Added

• Add allow_private_network in CORSMiddleware #​3065.

Changed

• Increase warning stacklevel on DeprecationWarning for wsgi module #​3082.

---

New Contributors

• @​santibreo made their first contribution in #​3082
• @​iddqd888 made their first contribution in #​3083

Full Changelog: Kludex/starlette@0.50.0...0.51.0

v0.50.0: Version 0.50.0

Compare Source

Removed

• Drop Python 3.9 support #​3061.

---

Full Changelog: Kludex/starlette@0.49.3...0.50.0

v0.49.3: Version 0.49.3

Compare Source

Fixed

• Relax strictness on Middleware type #​3059.

---

Full Changelog: Kludex/starlette@0.49.2...0.49.3

v0.49.2: Version 0.49.2

Compare Source

Fixed

• Ignore if-modified-since header if if-none-match is present in StaticFiles #​3044.

---

Full Changelog: Kludex/starlette@0.49.1...0.49.2

v0.49.1: Version 0.49.1

Compare Source

This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

• Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

---

Full Changelog: Kludex/starlette@0.49.0...0.49.1

v0.49.0: Version 0.49.0

Compare Source

Added

• Add encoding parameter to Config class #​2996.
• Support multiple cookie headers in Request.cookies #​3029.
• Use Literal type for WebSocketEndpoint encoding values #​3027.

Changed

• Do not pollute exception context in Middleware when using BaseHTTPMiddleware #​2976.

---

New Contributors

• @​TheWesDias made their first contribution in #​3017
• @​gmos2104 made their first contribution in #​3027
• @​secrett2633 made their first contribution in #​2996
• @​adam-sikora made their first contribution in #​2976

Full Changelog: Kludex/starlette@0.48.0...0.49.0

v0.48.0: Version 0.48.0

Compare Source

Added

• Add official Python 3.14 support #​3013.

Changed

• Implement RFC9110 http status names #​2939.

---

New Contributors

• @​yakimka made their first contribution in #​2943
• @​mbeijen made their first contribution in #​2939

Full Changelog: Kludex/starlette@0.47.3...0.48.0

v0.47.3: Version 0.47.3

Compare Source

Fixed

• Use asyncio.iscoroutinefunction for Python 3.12 and older by @​mjpieters in encode#2984

---

New Contributors

• @​mjpieters made their first contribution in encode#2984

Full Changelog: Kludex/starlette@0.47.2...0.47.3

v0.47.2

Compare Source

Fixed

• Make UploadFile check for future rollover #​2962.

---

New Contributors

• @​HonakerM made their first contribution in encode#2962

Full Changelog: Kludex/starlette@0.47.1...0.47.2

v0.47.1: Version 0.47.1

Compare Source

Fixed

• Use Self in TestClient.__enter__ #​2951
• Allow async exception handlers to type-check #​2949

---

Full Changelog: Kludex/starlette@0.47.0...0.47.1

v0.47.0: Version 0.47.0

Compare Source

Added

• Add support for ASGI pathsend extension #​2671.
• Add partitioned attribute to Response.set_cookie #​2501.

Changed

• Change methods parameter type from list[str] to Collection[str] #​2903.
• Replace import typing by from typing import ... in the whole codebase #​2867.

Fixed

• Mark ExceptionMiddleware.http_exception as async to prevent thread creation #​2922.

---

New Contributors

• @​danlapid made their first contribution in encode#2922
• @​Flecart made their first contribution in encode#2501
• @​AllenSH12 made their first contribution in encode#2936
• @​waketzheng made their first contribution in encode#2867
• @​jonathanberthias made their first contribution in encode#2903

Full Changelog: Kludex/starlette@0.46.2...0.47.0

v0.46.2: Version 0.46.2

Compare Source

What's Changed

• Use correct index on backwards compatible logic in TemplateResponse by @​alex-oleshkevich in encode#2909
• Prevents reraising of exception from BaseHTTPMiddleware by @​ramannanda9 in encode#2911

New Contributors

• @​ahryniv made their first contribution in encode#2913
• @​ramannanda9 made their first contribution in encode#2911

Full Changelog: Kludex/starlette@0.46.1...0.46.2

v0.46.1: Version 0.46.1

Compare Source

Fixed

• Allow relative directory path when follow_symlinks=True #​2896.

---

Full Changelog: Kludex/starlette@0.46.0...0.46.1

v0.46.0: Version 0.46.0

Compare Source

Added

• GZipMiddleware: Make sure Vary header is always added if a response can be compressed #​2865.

Fixed

• Raise exception from background task on BaseHTTPMiddleware #​2812.
• GZipMiddleware: Don't compress on server sent events #​2871.

Changed

• MultiPartParser: Rename max_file_size to spool_max_size #​2780.

Deprecated

• Add deprecated warning to TestClient(timeout=...) #​2840.

New Contributors

• @​musicinmybrain made their first contribution in encode#2855
• @​WilliamDEdwards made their first contribution in encode#2870
• @​mattmess1221 made their first contribution in encode#2865

Full Changelog: Kludex/starlette@0.45.3...0.46.0

v0.45.3: Version 0.45.3

Compare Source

Fixed

• Turn directory into string on lookup_path on commonpath comparison by @​Kludex in encode#2851

---

Full Changelog: Kludex/starlette@0.45.2...0.45.3

v0.45.2: Version 0.45.2

Compare Source

Fixed

• Make create_memory_object_stream compatible with old anyio versions once again, and bump anyio minimum version to 3.6.2 by @​graingert in #​2833.

Full Changelog: Kludex/starlette@0.45.1...0.45.2

v0.45.1: Version 0.45.1

Compare Source

Fixed

• Collect errors more reliably from WebSocket test client by @​graingert in encode#2814
• Fix unclosed MemoryObjectReceiveStream upon exception in BaseHTTPMiddleware children by @​Kludex in encode#2813

Refactor

• Use a pair of memory object streams instead of two queues by @​graingert in encode#2829

---

Full Changelog: Kludex/starlette@0.45.0...0.45.1

v0.45.0: Version 0.45.0

Compare Source

Removed

• Drop Python 3.8 by @​Kludex in encode#2823
• Remove ExceptionMiddleware import proxy from starlette.exceptions module by @​Kludex in encode#2826
• Remove deprecated WS_1004_NO_STATUS_RCVD and WS_1005_ABNORMAL_CLOSURE by @​Kludex in encode#2827

---

Full Changelog: Kludex/starlette@0.44.0...0.45.0

v0.44.0: Version 0.44.0

Compare Source

Added

• Add max_part_size parameter to Request.form() by @​iudeen in encode#2815
• Add client parameter to TestClient by @​iudeen in encode#2810

New Contributors

• @​iudeen made their first contribution in encode#2815

Full Changelog: Kludex/starlette@0.43.0...0.44.0

v0.43.0: Version 0.43.0

Compare Source

Removed

• Remove deprecated allow_redirects argument from TestClient #​2808.

Added

• Make UUID path parameter conversion more flexible #​2806.

---

New Contributors

• @​AbduazizZiyodov made their first contribution in encode#2799
• @​edthrn made their first contribution in encode#2806

Full Changelog: Kludex/starlette@0.42.0...0.43.0

v0.42.0: Version 0.42.0

Compare Source

Added

• Raise ClientDisconnect on StreamingResponse #​2732.

Fixed

• Use ETag from headers when parsing If-Range in FileResponse #​2761.
• Follow directory symlinks in StaticFiles when follow_symlinks=True #​2711.
• Bump minimum python-multipart version to 0.0.18 0ba8395.
• Bump minimum httpx version to 0.27.0 #​2773.

---

New Contributors

• @​logan-connolly made their first contribution in encode#2763
• @​eltoder made their first contribution in encode#2768
• @​hanxi made their first contribution in encode#2711
• @​viccie30 made their first contribution in encode#2761
• @​dbowring made their first contribution in encode#2782
• @​lealre made their first contribution in encode#2793

Full Changelog: Kludex/starlette@0.41.3...0.42.0

v0.41.3: Version 0.41.3

Compare Source

Fixed

• Exclude the query parameters from the scope[raw_path] on the TestClient #​2716.
• Replace dict by Mapping on HTTPException.headers #​2749.
• Correct middleware argument passing and improve factory pattern #​2752.

---

Full Changelog: Kludex/starlette@0.41.2...0.41.3

v0.41.2: Version 0.41.2

Compare Source

What's Changed

• Revert bump on python-multipart by @​Kludex in encode#2737

---

Full Changelog: Kludex/starlette@0.41.1...0.41.2

v0.41.1: Version 0.41.1

Compare Source

What's Changed

• Change python-multipart import to python_multipart by @​Kludex in encode#2733
• Bump minimum python-multipart version to 0.0.13 by @​Kludex in encode#2734

---

Full Changelog: Kludex/starlette@0.41.0...0.41.1

v0.41.0: Version 0.41.0

Compare Source

Added

• Allow to raise HTTPException before websocket.accept() encode#2725

v0.40.0: Version 0.40.0

Compare Source

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory:
GHSA-f96h-pmfr-66vw

Fixed

• Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data
  requests fd038f3.

v0.39.2: Version 0.39.2

Compare Source

Fixed

• Allow use of request.url_for when only "app" scope is available #​2672.
• Fix internal type hints to support python-multipart==0.0.12 #​2708.

---

Full Changelog: Kludex/starlette@0.39.1...0.39.2

v0.39.1: Version 0.39.1

Compare Source

Fixed

• Avoid regex re-compilation in responses.py and schemas.py #​2700.
• Improve performance of get_route_path by removing regular expression usage #​2701.
• Consider FileResponse.chunk_size when handling multiple ranges #​2703.
• Use token_hex for generating multipart boundary strings #​2702.

---

Full Changelog: Kludex/starlette@0.39.0...0.39.1

v0.39.0: Version 0.39.0

Compare Source

Added

• Add support for HTTP Range to FileResponse #​2697

---

Full Changelog: Kludex/starlette@0.38.6...0.39.0

v0.38.6: Version 0.38.6

Compare Source

Fixed

• Close unclosed MemoryObjectReceiveStream in TestClient #​2693.

---

Full Changelog: Kludex/starlette@0.38.5...0.38.6

v0.38.5: Version 0.38.5

Compare Source

Fixed

• Schedule BackgroundTasks from within BaseHTTPMiddleware #​2688.
  This behavior was removed in 0.38.3, and is now restored.

---

Full Changelog: Kludex/starlette@0.38.4...0.38.5

v0.38.4: Version 0.38.4

Compare Source

Fixed

• Ensure accurate root_path removal in get_route_path function #​2600

---

Full Changelog: Kludex/starlette@0.38.3...0.38.4

v0.38.3: Version 0.38.3

Compare Source

Added

• Support for Python 3.13 #​2662.

Fixed

• Don't poll for disconnects in BaseHTTPMiddleware via StreamingResponse #​2620.

---

Full Changelog: Kludex/starlette@0.38.2...0.38.3

v0.38.2: Version 0.38.2

Compare Source

Fixed

• Fix routing.get_name() not to assume all routines have __name__ #​2648

---

Full Changelog: Kludex/starlette@0.38.1...0.38.2

v0.38.1: Version 0.38.1

Compare Source

Removed

• Revert "Add support for ASGI pathsend extension" #​2649.

---

Full Changelog: Kludex/starlette@0.38.0...0.38.1

v0.38.0: Version 0.38.0

Compare Source

Added

• Allow use of memoryview in StreamingResponse and Response #​2576
  and #​2577.
• Send 404 instead of 500 when filename requested is too long on StaticFiles #​2583.

Changed

• Fail fast on invalid Jinja2Template instantiation parameters #​2568.
• Check endpoint handler is async only once #​2536.

Fixed

• Add proper synchronization to WebSocketTestSession #​2597.

---

Full Changelog: Kludex/starlette@0.37.2...0.38.0

v0.37.2: Version 0.37.2

Compare Source

Added

• Add bytes to _RequestData type #​2510.

Fixed

• Revert "Turn scope["client"] to None on TestClient (#​2377)" #​2525.
• Remove deprecated app argument passed to httpx.Client on the TestClient #​2526.

---

Full Changelog: Kludex/starlette@0.37.1...0.37.2

v0.37.1: Version 0.37.1

Compare Source

Fixed

• Warn instead of raise for missing env file on Config #​2485.

---

Full Changelog: Kludex/starlette@0.37.0...0.37.1

v0.37.0: Version 0.37.0

Compare Source

Added

• Support the WebSocket Denial Response ASGI extension #​2041.

---

Full Changelog: Kludex/starlette@0.36.3...0.37.0

v0.36.3: Version 0.36.3

Compare Source

Fixed

• Create anyio.Event on async context #​2459.

---

Full Changelog: Kludex/starlette@0.36.2...0.36.3

v0.36.2: Version 0.36.2

Compare Source

Fixed

• Upgrade python-multipart to 0.0.7 13e5c26.
• Avoid duplicate charset on Content-Type #​2443.

---

Full Changelog: Kludex/starlette@0.36.1...0.36.2

v0.36.1: Version 0.36.1

Compare Source

Fixed

• Check if "extensions" in scope before checking the extension #​2438.

---

Full Changelog: Kludex/starlette@0.36.0...0.36.1

v0.36.0: Version 0.36.0

Compare Source

Added

• Add support for ASGI pathsend extension #​2435.
• Cancel WebSocketTestSession on close #​2427.
• Raise WebSocketDisconnect when WebSocket.send() excepts IOError #​2425.
• Raise FileNotFoundError when the env_file parameter on Config is not valid #​2422.

---

Full Changelog: Kludex/starlette@0.35.1...0.36.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.