This release fixes a security vulnerability in the parsing logic of the Range header in FileResponse.

You can view the full security advisory: GHSA-7f5h-v6xp-fcq8

Fixed

• Optimize the HTTP ranges parsing logic 4ea6e22b489ec388d6004cfbca52dd5b147127c5

Full Changelog: 0.49.0...0.49.1

Added

• Add encoding parameter to Config class #2996.
• Support multiple cookie headers in Request.cookies #3029.
• Use Literal type for WebSocketEndpoint encoding values #3027.

Changed

• Do not pollute exception context in Middleware when using BaseHTTPMiddleware #2976.

New Contributors

• @TheWesDias made their first contribution in #3017
• @gmos2104 made their first contribution in #3027
• @secrett2633 made their first contribution in #2996
• @adam-sikora made their first contribution in #2976

Full Changelog: 0.48.0...0.49.0

Added

• Add official Python 3.14 support #3013.

Changed

• Implement RFC9110 http status names #2939.

New Contributors

• @yakimka made their first contribution in #2943
• @mbeijen made their first contribution in #2939

Full Changelog: 0.47.3...0.48.0

Fixed

• Use asyncio.iscoroutinefunction for Python 3.12 and older by @mjpieters in #2984

New Contributors

• @mjpieters made their first contribution in #2984

Full Changelog: 0.47.2...0.47.3

Fixed

• Make UploadFile check for future rollover #2962.

New Contributors

• @HonakerM made their first contribution in #2962

Full Changelog: 0.47.1...0.47.2

Fixed

• Use Self in TestClient.__enter__ #2951
• Allow async exception handlers to type-check #2949

Full Changelog: 0.47.0...0.47.1

Added

• Add support for ASGI pathsend extension #2671.
• Add partitioned attribute to Response.set_cookie #2501.

Changed

• Change methods parameter type from list[str] to Collection[str] #2903.
• Replace import typing by from typing import ... in the whole codebase #2867.

Fixed

• Mark ExceptionMiddleware.http_exception as async to prevent thread creation #2922.

New Contributors

• @danlapid made their first contribution in #2922
• @Flecart made their first contribution in #2501
• @AllenSH12 made their first contribution in #2936
• @waketzheng made their first contribution in #2867
• @jonathanberthias made their first contribution in #2903

Full Changelog: 0.46.2...0.47.0

What's Changed

• Use correct index on backwards compatible logic in TemplateResponse by @alex-oleshkevich in #2909
• Prevents reraising of exception from BaseHTTPMiddleware by @ramannanda9 in #2911

New Contributors

• @ahryniv made their first contribution in #2913
• @ramannanda9 made their first contribution in #2911

Full Changelog: 0.46.1...0.46.2

Fixed

• Allow relative directory path when follow_symlinks=True #2896.

Full Changelog: 0.46.0...0.46.1

Added

• GZipMiddleware: Make sure Vary header is always added if a response can be compressed #2865.

Fixed

• Raise exception from background task on BaseHTTPMiddleware #2812.
• GZipMiddleware: Don't compress on server sent events #2871.

Changed

• MultiPartParser: Rename max_file_size to spool_max_size #2780.

Deprecated

• Add deprecated warning to TestClient(timeout=...) #2840.

New Contributors

• @musicinmybrain made their first contribution in #2855
• @WilliamDEdwards made their first contribution in #2870
• @mattmess1221 made their first contribution in #2865

Full Changelog: 0.45.3...0.46.0