Version 0.40.0

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory:
GHSA-f96h-pmfr-66vw

Fixed

• Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data
  requests fd038f3.

Version 0.39.2

Fixed

• Allow use of request.url_for when only "app" scope is available #2672.
• Fix internal type hints to support python-multipart==0.0.12 #2708.

---

Full Changelog: 0.39.1...0.39.2

Version 0.39.1

Fixed

• Avoid regex re-compilation in responses.py and schemas.py #2700.
• Improve performance of get_route_path by removing regular expression usage #2701.
• Consider FileResponse.chunk_size when handling multiple ranges #2703.
• Use token_hex for generating multipart boundary strings #2702.

---

Full Changelog: 0.39.0...0.39.1

Version 0.39.0

Added

• Add support for HTTP Range to FileResponse #2697

---

Full Changelog: 0.38.6...0.39.0

Version 0.38.6

Fixed

• Close unclosed MemoryObjectReceiveStream in TestClient #2693.

---

Full Changelog: 0.38.5...0.38.6

Version 0.38.5

Fixed

• Schedule BackgroundTasks from within BaseHTTPMiddleware #2688.
  This behavior was removed in 0.38.3, and is now restored.

---

Full Changelog: 0.38.4...0.38.5

Version 0.38.4

Fixed

• Ensure accurate root_path removal in get_route_path function #2600

---

Full Changelog: 0.38.3...0.38.4

Version 0.38.3

Added

• Support for Python 3.13 #2662.

Fixed

• Don't poll for disconnects in BaseHTTPMiddleware via StreamingResponse #2620.

---

Full Changelog: 0.38.2...0.38.3

Version 0.38.2

Fixed

• Fix routing.get_name() not to assume all routines have __name__ #2648

---

Full Changelog: 0.38.1...0.38.2

Version 0.38.1

Removed

• Revert "Add support for ASGI pathsend extension" #2649.

---

Full Changelog: 0.38.0...0.38.1