Update responder requirement from <4 to <10

[dependabot]

Updates the requirements on responder to permit the latest version.

Release notes

Sourced from responder's releases.

v9.0.0

Responder 9.0

A major release: uploads that stream to disk instead of RAM, opt-in CSRF protection, first-class reverse-proxy support, and the v8.1 deprecation path becoming the default behavior.

Highlights

• Streaming multipart uploads — multipart bodies parse incrementally off the wire, spooling file parts to temporary files instead of buffering in memory. A 300 MB upload costs ~5 MB of server RSS. File() markers, req.media("files"), and req.media("form") share a single streaming parse.
• Bounded request bodies by default — max_request_size now defaults to 100 MiB (enforced chunk-by-chunk mid-stream); pass None for the old unlimited behavior. Since uploads spool to disk, a bigger cap doesn't mean more memory.
• Opt-in CSRF protection — API(csrf=True) guards unsafe methods with a session-bound token (X-CSRF-Token header or csrf_token form field; {{ req.csrf_input }} for templates), with per-route csrf= overrides for webhooks.
• Reverse-proxy support — API(trust_proxy_headers=True) honors RFC 7239 Forwarded and X-Forwarded-*, rewriting scheme/host/client so HTTPS detection, redirects, URL building, and logged/rate-limited IPs are correct behind nginx/Caddy/load balancers — consistently, even with repeated header lines.
• OpenAPI documents operational responses — CSRF 403, rate-limit 429/503, body-cap 413, and timeout 504 now appear in generated schemas, and rate-limit errors use RFC 9457 problem details.
• v9 behavior defaults — explicit port= beats the PORT env var, bare add_route() requires an endpoint, Decimal serializes as a precision-preserving string, GraphQL partial data returns 200, and api.session() is removed. Quiet compatibility switches remain for all of them.

Upgrading

Most apps need only small changes — see the v9 migration guide.

Full changelog: https://github.com/kennethreitz/responder/blob/main/CHANGELOG.md

---

📦 PyPI: https://pypi.org/project/responder/9.0.0/

Changelog

Sourced from responder's changelog.

[v9.0.0] - 2026-07-05

A major release: streaming multipart uploads, opt-in CSRF protection, reverse-proxy header support, and the v8.1 deprecation path becoming the default behavior. See the v9 migration guide for the full upgrade path.

Added

• Opt-in CSRF protection: API(csrf=True) requires unsafe requests (POST/PUT/PATCH/DELETE) to present the session-bound token from req.csrf_token in an X-CSRF-Token header or csrf_token form field ({{ req.csrf_input }} renders the hidden input for templates), rejecting the rest with a 403. Per-route overrides via @api.route(..., csrf=False) (webhook receivers) or csrf=True (protect a single route). The token check shares the request's single streaming form parse. Off by default; requires sessions.
• Proxy-headers support: API(trust_proxy_headers=True) now installs a middleware honoring RFC 7239 Forwarded and X-Forwarded-Proto/X-Forwarded-Host/X-Forwarded-For/X-Real-IP, rewriting the request's scheme, host, and client address to what the original client sent — HTTPS detection, redirects, URL building, trusted-host validation, and logged client IPs are then correct behind nginx/Caddy/load balancers.
• Streaming multipart uploads: multipart bodies now parse incrementally off the wire, spooling file parts to temporary files (rolling to disk past ~1 MB) instead of buffering the whole body in RAM. File() markers, req.media("files"), and req.media("form") all share the single streaming parse, and max_request_size is enforced chunk-by-chunk as the body arrives — uploads are bounded by disk, not memory.

Changed

• trust_proxy_headers=True previously only affected the client IP recorded by enable_logging; it now rewrites the connection's scheme, host, and client address for the whole stack (see Added). Apps that enabled it purely for logging get the same logged IPs, plus correct scheme/host handling.
• max_request_size now defaults to 100 MiB instead of unlimited; pass API(max_request_size=None) for the previous behavior. Oversized bodies get a 413 as before.
• Generated OpenAPI operations now document Responder's operational responses: CSRF-protected unsafe routes get 403, rate-limited routes get 429 (and fail-closed backend 503), and request-size 413 is emitted only when a body cap is active. Rate limiter 429/503 responses now honor API(problem_details=True) and keep the legacy {"error": ...} JSON shape when problem_details=False.
• Because multipart parsing streams, the raw body is consumed by the parse: await req.content after media("form"/"files") raises a clear RuntimeError (await req.content first to keep the buffered, replayable

... (truncated)

Commits

• e6f2521 Bump version to 9.0.0 and update changelog
• 588919b Note OpenAPI visibility of rate limiting and the 429/503 body change
• 99a90aa Document operational responses in OpenAPI
• f6cd6e1 Join repeated forwarding-header lines before resolving the client IP
• 5876a28 Honor RFC 7239 Forwarded in the shared client-IP resolver
• dbc0a43 Surface CSRF, proxy trust, and body cap in production docs
• 5c81652 Fix route-level csrf=True without sessions and IPv6 forwarded-host parsing
• 534c489 Add opt-in CSRF protection and proxy-headers support
• 8f3a207 Stream multipart uploads to disk; bound request bodies by default
• a080b23 Merge codex/prep-v9: flip v9 behavior defaults
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.56%. Comparing base (e99ba07) to head (9eda36c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #56   +/-   ##
=======================================
  Coverage   82.56%   82.56%           
=======================================
  Files          12       12           
  Lines         218      218           
=======================================
  Hits          180      180           
  Misses         38       38           

Flag	Coverage Δ
unittests	82.56% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.