[dependabot]

Updates the requirements on starlette to permit the latest version.

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
• Resolve the multipart charset once per request instead of once per field #3618.

Fixed

• Preserve response trailers through GZipMiddleware #3565.
• Stop FileResponse transfers when the client disconnects #3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
• Ignore Range when If-Range contains a weak ETag #3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
• Add Vary: Cookie when Session.pop() removes an existing key #3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
• Bracket IPv6 hostnames in URL.replace() #3617.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

... (truncated)

Commits

• 1840c9d Version 1.9.0 (#3676)
• 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
• 414af4f Remove unmaintained packages from the third-party packages page (#3674)
• d4df01a Add adminsite to the third-party packages (#3654)
• 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
• a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
• 6b11cd7 Honor streaming responses in TestClient (#3491)
• b7901fb Use byte length for typed memoryview response bodies (#3622)
• 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
• 7b2948f Version 1.8.0 (#3660)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T18:29:42.058795Z	f6a00f5	New commits
🔒 Security Review	✅ Completed 2026-10-27T18:30:08.653086Z	f6a00f5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: def2ac000c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jbeckwith-oai]

Reviewed the complete final PR diff and combined integration with two independent reviewers; no remaining blocking findings. The final Python markers preserve documented Python 3.10 compatibility while applying the update on Python 3.11+. Requirements resolve on both interpreter generations, and all 51 Twilio tests passed with the actual upgraded Starlette/HTTPX2/FastAPI versions. Merge remains contingent on fresh CI completing successfully.

[markstuart-oai]

Reviewed e4c1563f07df24245cb16cfe6e361ed2bc6c8477. The split Starlette requirements preserve starlette>=1.7.0 on Python 3.10 and require >=1.9.0 on Python 3.11 and later. The markers are exhaustive and non-overlapping, and the remaining example requirements are unchanged. This resolves the earlier unconditional-floor compatibility finding.

Source-only review; I did not execute candidate code, install dependencies, or rerun the author-reported focused tests. Hosted checks on this head: 23 passed and 2 skipped. No remaining actionable finding in this change.