Starlette is a lightweight ASGI framework and toolkit for building async web services in Python. It provides HTTP and WebSocket support, plus features like startup and shutdown events, background tasks, and common web middleware options (such as CORS and static files), making it useful for production-ready async APIs and web apps.
Project status
- Actively maintained: The repo shows recent upstream activity (last push on 2026-10-13) and frequent “updates” through 2026, indicating ongoing maintenance rather than a dormant state.
- Update cadence: Updates appear roughly every few weeks to two months in 2026 (for example, 1.7.0 on 2026-09-23, 1.8.0 on 2026-10-13), with some earlier clustering around 2026-08-08.
AI summary generated
Recent updates
1.9.0
Starlette 1.9.0 updates how `TestClient` streams response bodies, so `client.stream()` returns before the application finishes, and closing an unfinished stream cancels the running application. It also includes several correctness fixes around URL/path escaping, content length computation for memoryviews, `Allow` headers for `HEAD`, case-insensitive host routing, and preserving existing `Vary` headers.
Breaking1.8.0
Starlette 1.8.0 adds support for HTTP 103 Early Hints via the ASGI `http.response.early_hint` extension, including a new `Request.send_early_hints()` helper. It also adjusts middleware behavior around compression and streaming, specifically preserving gzip trailers, excluding native gRPC content types from gzip compression by default, and stopping `FileResponse` transfers when the client disconnects. This release requires Python 3.11 or later.
BreakingFeatures1.7.0
Starlette 1.7.0 introduces experimental OpenTelemetry tracing, adds support for the HTTP QUERY method, and enhances TestClient by capturing HTTP response trailers. It also includes multiple behavioral fixes across middleware, CORS, multipart parsing, static files, sessions, and WebSocket handling, and it raises the minimum AnyIO requirement to AnyIO 4.
BreakingFeatures1.6.0
Starlette 1.6.0 adds request body size limiting via a new max_body_size option on the Starlette app and route/router/mount classes, enforced by a RequestBodyLimitMiddleware. It also exposes ASGI http.response.debug info through TestClient response.extensions so tests can access debug metadata without parsing the body.
Features1.5.1
Version 1.5.1 updates `FileResponse` range handling to reject inverted single-byte ranges and to cap the number of ranges it will process. The release notes mention only those `Range` parsing changes.
Breaking1.5.0
Version 1.5.0 focuses on improving Starlette's GZipMiddleware behavior for streaming responses and adds configurability around which Content-Types are excluded from compression. It introduces an exclude_content_types parameter, updates the default excluded media types, flushes gzip output per streamed chunk, and avoids compressing partial (206) responses.
BreakingFeatures1.4.1
Version 1.4.1 updates Starlette's GZipResponder middleware to provide a default value for the `thread_minimum_size` parameter. The release notes indicate this is specifically to keep the middleware usable without requiring a newly introduced keyword argument.
1.4.0
Starlette 1.4.0 focuses on performance and responsiveness improvements to `GZipMiddleware`. The middleware now supports worker-thread offloading for larger payloads, uses `zlib.compressobj` for compression, and lazily allocates compression resources only when compression is actually performed.
Features1.3.1
Version 1.3.1 changes several deprecation warnings to use StarletteDeprecationWarning instead of DeprecationWarning. It also adds strict enforcement of form parsing limits (max_fields and max_part_size) inside FormParser and applies those limits when parsing form data, causing requests that exceed defaults to be rejected.
Breaking1.3.0
Starlette 1.3.0 focuses on request URL construction correctness, multipart/file response edge cases, and improved exception group handling. It also switches TestClient-related dependency expectations toward httpx2 via extras and updated docs.
Features1.2.1
Release 1.2.1 primarily addresses type-checking improvements around the `testclient` module and adds clearer assertion failures when authentication `requires()` is used with an incorrect request type. The release notes do not mention broader tooling and dependency updates that are present in the diff.
1.2.0
Version 1.2.0 updates Starlette to support httpx2 in its test client, adding httpx2 related dependencies and adjusting test expectations. The release notes mention only httpx2 support, but the code also changes warning behavior and HTTP headers produced by the test client.
BreakingFeatures1.1.0
Version 1.1.0 updates Starlette's behavior around file responses, endpoint dispatching, and static file path handling. The release notes document three main changes: new default media type for FileResponse when guessing fails, restricting HTTPEndpoint dispatch to allowed HTTP verbs, and rejecting absolute paths in StaticFiles.lookup_path.
BreakingSecurity1.0.1
Starlette 1.0.1 primarily fixes URL construction when the incoming ASGI scope includes a malformed Host header. The code now ignores invalid Host values when building `request.url`, falling back to the server tuple. The rest of the diff is mostly documentation, CI, and development tooling updates.
1.0.0
Starlette 1.0.0 promotes the 1.0 release candidate to a stable release. Most functional changes highlighted in the release notes are centered around SessionMiddleware tracking (access and modification), multipart/form parsing robustness, and improved websocket denial handling in responses.
Features1.0.0rc1
Starlette 1.0.0rc1 is the first release candidate for the 1.0 line, focused on removing deprecated features slated for 1.0.0 plus some last-minute bug fixes. The release notes also document the required migration away from startup/shutdown and various decorator-based APIs toward the lifespan and parameter-based configuration model.
Breaking0.52.1
Starlette 0.52.1 is a small patch release. The documented change limits usage of `typing_extensions` to older Python versions, while newer Python versions use the standard library `typing` equivalents.
0.52.0
Starlette 0.52.0 adds dictionary-style access to lifespan state (for example, `request.state['http_client']`) to improve type safety. The release notes primarily focus on this new access pattern and its typing example.
Features0.51.0
Starlette 0.51.0 adds a new CORSMiddleware option, allow_private_network, to support browser Private Network Access (PNA) preflight requests. It also updates the stacklevel for the wsgi middleware deprecation DeprecationWarning to improve where the warning points in user code.
Features0.50.0
Starlette 0.50.0 primarily drops Python 3.9 support, raising the minimum supported Python version. The code diff also includes widespread modernization of type imports and union syntax across the codebase, plus dependency/CI/test adjustments aligned with the Python floor change.
Breaking