Kludex/uvicorn

Recent updates

• 0.49.0

  2026-06-03

  Version 0.49.0 bumps the minimum required version of httptools and changes how ProxyHeadersMiddleware handles duplicated forwarding headers. Specifically, it now consumes duplicate X-Forwarded-For and X-Forwarded-Proto values instead of ignoring them, reversing the prior 0.48.0 behavior.

  Breaking

• 0.48.0

  2026-05-24

  Version 0.48.0 changes the default SSL cipher configuration to rely on OpenSSL safe defaults by setting `ssl_ciphers` to `None`. It also updates `ProxyHeadersMiddleware` to ignore duplicate `X-Forwarded-*` headers (notably `x-forwarded-for` and `x-forwarded-proto`) to reduce spoofing risk.

  Breaking

• 0.47.0

  2026-05-14

  This release adds a new `ssl_context_factory` hook for advanced TLS setup, eagerly imports the ASGI app in the parent process, and fixes `fd=0` handling when using reload or worker modes. The rest of the patch is mostly documentation, sponsor page/site updates, and a small CI permissions cleanup.

  Features

• 0.46.0

  2026-04-23

  Version 0.46.0 primarily expands websocket backend parity. `wsproto` gains support for `ws_max_size`, `ws_ping_interval`, and `ws_ping_timeout`, while `websockets-sansio` switches to a mutable incoming message buffer for better handling of websocket payloads.

  Features

• 0.45.0

  2026-04-21

  Version 0.45.0 focuses on request context isolation, logging configuration ergonomics, and proxy header correctness. It also reverts the temporary shutdown disconnect behavior for streaming HTTP responses and adds logging documentation.

  BreakingFeatures

• 0.44.0

  2026-04-06

  Uvicorn 0.44.0 adds automatic websocket keepalive support for the websockets-sansio backend and updates the settings docs to show that ws_ping_interval and ws_ping_timeout now apply to it. The release also bumps the package version and adds tests covering normal ping/pong round trips, ping timeout disconnects, and disabled keepalive behavior.

  Features

• 0.43.0

  2026-04-03

  Uvicorn 0.43.0 is a small release focused on shutdown behavior for streaming responses, Python 3.11 task creation compatibility, and ASGI typing cleanup. The runtime diff also includes a few internal hardening changes, plus a dependency lock refresh and CI workflow updates.

• 0.42.0

  2026-03-16

  This release focuses on internal HTTP and WebSocket protocol improvements, especially better request body accumulation performance and fixes for httptools header parsing and websockets sans-io edge cases. The visible diff also adds benchmark infrastructure and updates CI tooling, but those changes are mostly development oriented.

• 0.41.0

  2026-02-16

  Version 0.41.0 adds request limit jitter to stagger worker restarts and expands server scope metadata to include Unix socket paths. It also renames a lifespan internals attribute and fixes several edge cases around shutdown, reloading, and request-limit logging, while refreshing build and dependency metadata.

  BreakingFeatures

• 0.40.0

  2025-12-21

  This release is mainly a platform support drop, raising the minimum supported Python version to 3.10 and removing Python 3.9 from CI, packaging metadata, and the lockfile. The code diff is dominated by internal typing modernizations and test cleanup, with no obvious runtime feature additions.

  Breaking

• 0.39.0

  2025-12-21

  Version 0.39.0 is a focused bugfix release. It fixes websocket shutdown behavior when an ASGI app returns and prevents ContextVar state from leaking into new ASGI runs on asyncio-based HTTP protocols. The rest of the diff is mostly test coverage, release note documentation, and GitHub Actions maintenance.

• 0.38.0

  2025-10-18

  Release 0.38.0 adds support for Python 3.14. No other functional changes, bug fixes, or breaking changes are mentioned in the release notes.

  Features