Update dependency starlette to ~=1.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
starlette (changelog)	~=1.7.0 → ~=1.9.0

---

Release Notes

Kludex/starlette (starlette)

v1.9.0: Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #​3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #​3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #​3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #​3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #​3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #​3675.

Full changelog: 1.8.0...1.9.0

v1.8.0: Version 1.8.0

Compare Source

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

• Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #​3435.

Changed

• Require Python 3.11 or later, dropping support for Python 3.10 #​3592.
• Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #​3565.
• Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #​3631.
• Resolve the multipart charset once per request instead of once per field #​3618.

Fixed

• Preserve response trailers through GZipMiddleware #​3565.
• Stop FileResponse transfers when the client disconnects #​3523.
• Stop multipart range responses when the file ends before a range is complete, instead of looping forever #​3583.
• Ignore Range when If-Range contains a weak ETag #​3567.
• Include Allow: GET, HEAD in StaticFiles 405 responses #​3640.
• Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #​3628.
• Add Vary: Cookie when Session.pop() removes an existing key #​3186.
• Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #​3651.
• Bracket IPv6 hostnames in URL.replace() #​3617.

Full changelog: 1.7.0...1.8.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6:00am on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.