Starlette is a lightweight ASGI framework and toolkit for building async web services in Python. It provides HTTP and WebSocket support, plus features like startup and shutdown events, background tasks, and common web middleware options (such as CORS and static files), making it useful for production-ready async APIs and web apps.
Project status
- Actively maintained: The repository shows very recent upstream pushes and frequent tagged updates in August 2026 (for example, updates on 2026-08-08 and an upstream push on 2026-08-11), indicating active maintenance rather than a dormant state.
- Cadence: Updates appear to be at least weekly, with multiple version updates clustered in the first week of August 2026 and no long multi-month gaps in the provided history.
AI summary generated
Recent updates
1.6.0
Starlette 1.6.0 adds request body size limiting via a new max_body_size option on the Starlette app and route/router/mount classes, enforced by a RequestBodyLimitMiddleware. It also exposes ASGI http.response.debug info through TestClient response.extensions so tests can access debug metadata without parsing the body.
Features1.5.1
Version 1.5.1 updates `FileResponse` range handling to reject inverted single-byte ranges and to cap the number of ranges it will process. The release notes mention only those `Range` parsing changes.
Breaking1.5.0
Version 1.5.0 focuses on improving Starlette's GZipMiddleware behavior for streaming responses and adds configurability around which Content-Types are excluded from compression. It introduces an exclude_content_types parameter, updates the default excluded media types, flushes gzip output per streamed chunk, and avoids compressing partial (206) responses.
BreakingFeatures1.4.1
Version 1.4.1 updates Starlette's GZipResponder middleware to provide a default value for the `thread_minimum_size` parameter. The release notes indicate this is specifically to keep the middleware usable without requiring a newly introduced keyword argument.
1.4.0
Starlette 1.4.0 focuses on performance and responsiveness improvements to `GZipMiddleware`. The middleware now supports worker-thread offloading for larger payloads, uses `zlib.compressobj` for compression, and lazily allocates compression resources only when compression is actually performed.
Features1.3.1
Version 1.3.1 changes several deprecation warnings to use StarletteDeprecationWarning instead of DeprecationWarning. It also adds strict enforcement of form parsing limits (max_fields and max_part_size) inside FormParser and applies those limits when parsing form data, causing requests that exceed defaults to be rejected.
Breaking1.3.0
Starlette 1.3.0 focuses on request URL construction correctness, multipart/file response edge cases, and improved exception group handling. It also switches TestClient-related dependency expectations toward httpx2 via extras and updated docs.
Features1.2.1
Release 1.2.1 primarily addresses type-checking improvements around the `testclient` module and adds clearer assertion failures when authentication `requires()` is used with an incorrect request type. The release notes do not mention broader tooling and dependency updates that are present in the diff.
1.2.0
Version 1.2.0 updates Starlette to support httpx2 in its test client, adding httpx2 related dependencies and adjusting test expectations. The release notes mention only httpx2 support, but the code also changes warning behavior and HTTP headers produced by the test client.
BreakingFeatures1.1.0
Version 1.1.0 updates Starlette's behavior around file responses, endpoint dispatching, and static file path handling. The release notes document three main changes: new default media type for FileResponse when guessing fails, restricting HTTPEndpoint dispatch to allowed HTTP verbs, and rejecting absolute paths in StaticFiles.lookup_path.
BreakingSecurity1.0.1
Starlette 1.0.1 primarily fixes URL construction when the incoming ASGI scope includes a malformed Host header. The code now ignores invalid Host values when building `request.url`, falling back to the server tuple. The rest of the diff is mostly documentation, CI, and development tooling updates.
1.0.0
Starlette 1.0.0 promotes the 1.0 release candidate to a stable release. Most functional changes highlighted in the release notes are centered around SessionMiddleware tracking (access and modification), multipart/form parsing robustness, and improved websocket denial handling in responses.
Features1.0.0rc1
Starlette 1.0.0rc1 is the first release candidate for the 1.0 line, focused on removing deprecated features slated for 1.0.0 plus some last-minute bug fixes. The release notes also document the required migration away from startup/shutdown and various decorator-based APIs toward the lifespan and parameter-based configuration model.
Breaking0.52.1
Starlette 0.52.1 is a small patch release. The documented change limits usage of `typing_extensions` to older Python versions, while newer Python versions use the standard library `typing` equivalents.
0.52.0
Starlette 0.52.0 adds dictionary-style access to lifespan state (for example, `request.state['http_client']`) to improve type safety. The release notes primarily focus on this new access pattern and its typing example.
Features0.51.0
Starlette 0.51.0 adds a new CORSMiddleware option, allow_private_network, to support browser Private Network Access (PNA) preflight requests. It also updates the stacklevel for the wsgi middleware deprecation DeprecationWarning to improve where the warning points in user code.
Features0.50.0
Starlette 0.50.0 primarily drops Python 3.9 support, raising the minimum supported Python version. The code diff also includes widespread modernization of type imports and union syntax across the codebase, plus dependency/CI/test adjustments aligned with the Python floor change.
Breaking0.49.3
Starlette 0.49.3 primarily updates type annotations for the `Middleware` typing to be less strict. The accompanying release notes mention this typing relaxation, and the code change is confined to type definitions in `starlette/middleware/__init__.py`, plus a version bump and a release notes documentation update.
0.49.2
Version 0.49.2 is a small update that fixes StaticFiles caching behavior when both ETag and conditional timestamp headers are involved. The release notes only mention one functional fix, and the code diff confirms that logic change in `starlette/staticfiles.py`. Additionally, multiple CI workflow action versions were bumped, and one internal error-handling path in `StaticFiles.is_not_modified` was removed.
0.49.1
Starlette 0.49.1 addresses a security vulnerability related to how `FileResponse` parses the HTTP `Range` header. The code changes replace the previous regex-based parsing with new, more defensive range parsing logic and add test coverage for malformed or edge-case `Range` values.
Security