This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

Added

• Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
• Expose the matched route through scope["route"] #3438.
• Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
• Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
• Support partitioned cookies in SessionMiddleware #3510.
• Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
• Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
• Support Python 3.15 #3508.

Changed

• Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
• Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
• Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

• Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.
• Return 400 for invalid multipart parser input #3492.
• Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.
• Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.
• Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.
• Handle standalone If-None-Match: * in StaticFiles #3201.
• Reject WebSocket requests to StaticFiles without raising an assertion error #3532.
• Persist session mutations made with popitem() and |= #3436.
• Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.
• Implement identity on SimpleUser and UnauthenticatedUser #3271.
• Allow HTTPException to use non-standard status codes without an explicit detail #3545.
• Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.
• Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

What's Changed

• Add max_body_size to Starlette and route classes by @Kludex in #3431
• Expose http.response.debug info via response extensions by @y2kbugger in #3130

New Contributors

• @y2kbugger made their first contribution in #3130

Full Changelog: 1.5.1...1.6.0

What's Changed

• Reject inverted single-byte Range like bytes=5-4 by @nikolauspschuetz in #3389
• Limit FileResponse to 100 ranges by @Kludex in #3430

Full Changelog: 1.5.0...1.5.1

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

• Add exclude_content_types parameter to GZipMiddleware by @Kludex in #3418
• Flush GZip output for each streamed chunk by @Kludex in #3419
• Skip compression of partial responses in GZipMiddleware by @Kludex in #3420
• Expand default excluded content types in GZipMiddleware by @Kludex in #3421

Full Changelog: 1.4.1...1.5.0

What's Changed

• Default thread_minimum_size in GZipResponder by @Kludex in #3415

Full Changelog: 1.4.0...1.4.1

What's Changed

• Lazily allocate GZipMiddleware compression resources by @Kludex in #3407
• Use zlib.compressobj instead of GzipFile in GZipMiddleware by @Kludex in #3411
• Offload large GZip compression by @Kludex in #3410

New Contributors

• @benberryallwood made their first contribution in #3334
• @lkk7 made their first contribution in #3359

Full Changelog: 1.3.1...1.4.0

What's Changed

• Use StarletteDeprecationWarning instead of DeprecationWarning by @Kludex in #3119
• Enforce max_fields and max_part_size in FormParser by @Kludex in #3329
• Enforce FormParser limits in parser callbacks by @Kludex in #3331

Full Changelog: 1.3.0...1.3.1

What's Changed

• Clamp oversized suffix ranges in FileResponse by @jiyujie2006 in #3307
• Catch OSError alongside MultiPartException when closing temp files by @N3XT3R1337 in #3191
• Add httpx2 to the full extra by @Kludex in #3323
• Adjust testclient typing and warnings by @waketzheng in #3322
• Fix IndexError in URL.replace() on a URL with no authority by @LeSingh1 in #3317
• Annotate URLPath protocol parameter with Literal by @Chang-LeHung in #3285
• avoid collapsing exception groups from user code by @graingert in #2830
• Use removeprefix to strip weak ETag indicator in is_not_modified by @gnosyslambda in #3193
• Build request.url from structured components by @Kludex in #3326

New Contributors

• @jiyujie2006 made their first contribution in #3307
• @N3XT3R1337 made their first contribution in #3191
• @leestana01 made their first contribution in #3319
• @LeSingh1 made their first contribution in #3317
• @EmmanuelNiyonshuti made their first contribution in #3204
• @Chang-LeHung made their first contribution in #3285
• @gnosyslambda made their first contribution in #3193

Full Changelog: 1.2.1...1.3.0

What's Changed

• Use httpx2 for type checking in the testclient module by @leifwar in #3304
• Add assert error for requires() when request param is not Request type by @KeeganOP in #3298

New Contributors

• @leifwar made their first contribution in #3304
• @diskeu made their first contribution in #3243
• @KeeganOP made their first contribution in #3298

Full Changelog: 1.2.0...1.2.1

What's Changed

• Support httpx2 in the test client by @Kludex in #3291

Full Changelog: 1.1.0...1.2.0