v2.14.0

Summary

We are pleased to publish our first release of 2025!

Since our last release in November, everyone's been busy. In that short time, we've managed to squeeze in a huge amount of fixes, features, and (most, importantly) Python 3.13 support. Thank you to everyone in the community who contributed to this.

As we move towards 3.0, you'll see a few deprecations being added to packages. Please don't hesitate to join our discord to discuss any deprecation specifics or any other change you'd like to see in 3.0

Sponsors 🌟

• A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @ftsartek made their first contribution in #3892
• @adhtruong made their first contribution in #3880
• @wallseat made their first contribution in #3525
• @250MHz made their first contribution in #3920
• @vikigenius made their first contribution in #3876

Bugfixes 🐛

• fix: remove optional group for litestar-htmx by @cofin in #3870
• fix(pydantic): Add moved URL types to type map by @provinzkraut in #3874
• fix: patching of otel middleware to work with subclasses by @vikigenius in #3876
• fix(ci): Pin PDM version for 3.8 by @Alc-Alc in #3878
• fix: update Makefile by @adhtruong in #3880
• fix(devcontainers): Replace PDM with UV by @Alc-Alc in #3879
• fix: resource warnings by @gsakkis in #3838
• fix: Enum OAS generation (#3518) by @wallseat in #3525
• fix: typo in exception message for ImproperlyConfiguredException by @Zimzozaur in #3885
• fix(file response): Support varying mtime semantics across different fsspec implementations by @provinzkraut in #3902
• fix(OpenAPI): Query-only properties included in path, cookie and header parameter schema and response headers (#3908) by @provinzkraut in #3909
• fix(sqlalchemy): updates to documentation based on upstream changes by @cofin in #3917
• fix(picologging): better handle unsupported environments by @cofin in #3918
• fix(channels): use SQL function for psycopg by @cofin in #3916
• fix(compression middleware): Fix resource handling by @provinzkraut in #3927
• fix(ci): only install dev tools in ubuntu by @cofin in #3931

New features 🚀

• feat: move litestar.contrib.prometheus to litestar.plugins.prometheus by @cofin in #3863
• feat: move litestar.contrib.attrs to litestar.plugins.attrs by @cofin in #3862
• feat: add future flag to experimental_features by @cofin in #3864
• feat(core): Streaming multipart parser by @provinzkraut in #3872
• feat: upgrade minimum litestar-htmx version by @cofin in #3884
• feat: WebSocket send stream by @provinzkraut in #3894
• feat: add query params to redirect response by @marcuslimdw in #3901
• feat: add Valkey as a native store by @ftsartek in #3892
• feat: use "path" as an error message source by @250MHz in #3920
• feat: added subprocess test client by @aranvir in #3655
• feat: add support for Python 3.13 by @cofin in #3850
• feat(ci): implement psycopg client installation for macos and windows by @cofin in #3932

Other changes

• docs: fix advanced alchemy references by @cofin in #3881
• docs: remove deprecated sponsor STOK by @cbscsm in #3915
• docs: mention id field in 1-abstract-dto.rst by @sobolevn in #3803

Full Changelog
v2.13.0...v2.14.0

v2.13.0

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar)
• Telemetry Sports (via @chris-telemetry)
• Avra

And a huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @vvanglro made their first contribution in #3849
• @wallseat made their first contribution in #3807
• @mohammedbabelly20 made their first contribution in #3784
• @cemrehancavdar made their first contribution in #3845
• @eliasfandi made their first contribution in #3768
• @RenameMe1 made their first contribution in #3857
• @olzhasar made their first contribution in #3765
• @findstar made their first contribution in #3751
• @pogopaule made their first contribution in #3776
• @charles-dyfis-net made their first contribution in #3767

Bugfixes 🐛

• fix: sign bug in rate limit middelware by @pogopaule in #3776
• fix: map JSONSchema spec naming convention to snake_case when names from schema_extra are not found (#3766) by @charles-dyfis-net in #3767
• fix: typo in a deprecation warning in contrib/sqlalchemy/plugins/serialization.py by @sobolevn in #3809
• fix(prometheus): fix path template for routes without path parameters by @mohammedbabelly20 in #3784
• fix: LifespanHandler memory stream cleanup by @provinzkraut in #3836
• fix: set correct path_template value for trie node (#3806) by @wallseat in #3807
• fix: Safe Handling of "more_body" in ASGI Responses by @cemrehancavdar in #3845
• fix: Duplicate RateLimit-* headers with caching by @mohammedbabelly20 in #3855

New features 🚀

• feat: OpenAPI plugins send CSRF request header by @floxay in #3754
• feat: deprecate litestar.contrib.sqlalchemy by @cofin in #3755
• feat: implement HTMX plugin using litestar-htmx by @cofin in #3837
• feat(Pydantic): honor hide_input_in_errors in throwing validation exceptions by @charles-dyfis-net in #3843
• feat: deprecate litestar.contrib.pydantic by @cofin in #3852

Documentation

• docs: update copyright notice year to 2024 by @findstar in #3751
• docs(readme): Remove reference to litestar-pg-redis-docker by @Alc-Alc in #3779
• docs: Fix python code highlight in many examples by @sobolevn in #3788
• docs: fix a typo in requests usage docs by @sobolevn in #3794
• docs: fix typos in sqlalchemy examples by @sobolevn in #3798
• docs: fix typos in sqlalchemy/models_and_repository.rst by @sobolevn in #3797
• docs: fix missing import in cache usage by @sobolevn in #3795
• docs: make sure that channels use finally in all examples by @sobolevn in #3796
• docs: change the ExperimentalFeatures.DTO_CODEGEN description by @sobolevn in #3802
• docs: change sync-to-thread-info.rst wording about sync_to_thread by @sobolevn in #3799
• docs: add missing rename strategy to dto docs by @sobolevn in #3805
• docs: fix highlighted lines in DTO usage by @sobolevn in #3808
• docs: fix "DTO Factory and PATCH requests" section by @sobolevn in #3819
• docs: fix DTO Data section with a new example by @sobolevn in #3813
• docs: fix highlight of code example in "Providing values for nested data" by @sobolevn in #3815
• docs: rewrite htmx guide by @sobolevn in #3825
• docs: refactor "Hooks" usage documentation by @sobolevn in #3826
• docs: fix API reference for asgi_types scopes by @sobolevn in #3831
• docs: rewrite "Builtin middleware" usage by @sobolevn in #3830
• docs: refactor "Custom Middleware" guide by @sobolevn in #3833
• docs: refactor exception usage by @sobolevn in #3823
• docs: remove references to python-jose by @cofin in #3847
• docs: Changing incorrect indentation in the code example "creating-middleware#inheriting-abstractmiddleware" by @RenameMe1 in #3857
• docs: improve openapi/index.rst page by @sobolevn in #3856
• docs: fix the description of when to use the synchronous function by @vvanglro in #3849
• docs: Added debug=True in Testing to display exception stack trace by @RenameMe1 in #3860

Full Changelog
v2.12.1...v2.13.0

v2.12.1

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Avra

A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

Bugfixes 🐛

• fix(typing): Don't require annotated_types by @provinzkraut in #3750

Full Changelog
v2.12.0...v2.12.1

v2.12.0

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Avra

Thanks to these incredible personal sponsors:

• Polar.sh: @Nozavi, @cemrehancavdar, @thomastu, @skewty, @iRod3s
• GitHub Sponsors: @roboflow, @benjamin-kirkbride, @crisog, @geeshta, @cbscsm, @ruslan-korneev
• OpenCollective: Christian Y, Anonymous

A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

Bugfixes 🐛

• Fix overzealous warning for greedy middleware exclude pattern by @euri10 in #3712
• Fix dangling coroutines in request extraction handling cleanup by @provinzkraut in #3735
• Fix OpenAPI handling of type keyword by @provinzkraut in #3715
• Fix OpenAPI handling of invalid schema keys by @thiagozf in #3635
• Fix OpenAPI handling of msgspec.Struct tagged unions by @provinzkraut in #3742

New features 🚀

• Support strings in media_type for ResponseSpec by @provinzkraut in #3729
• Allow customizing schema component keys by @provinzkraut in #3738
• Raise exception when body parameter is annotated with non-bytes type by @provinzkraut in #3740
• Bump scalar OpenAPI Plugin to latest release by @cofin in #3747

Other changes

• Overhauled metadata handling by @provinzkraut in #3721

Full Changelog
v2.11.0...v2.12.0

v2.11.0

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Avra

Thanks to these incredible personal sponsors:

• Polar.sh: @Nozavi, @cemrehancavdar, @thomastu, @skewty, @iRod3s
• GitHub Sponsors: @roboflow, @benjamin-kirkbride, @crisog, @geeshta, @cbscsm, @ruslan-korneev
• OpenCollective: Christian Y, Anonymous

A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @supercoder-dev made their first contribution in #3565
• @jlr295 made their first contribution in #3660
• @aarcex3 made their first contribution in #3703
• @Zimzozaur made their first contribution in #3661
• @stewit made their first contribution in #3603
• @trim21 made their first contribution in #3698
• @FarhanAliRaza made their first contribution in #3702

Bugfixes 🐛

• fix(connection): Fix creation of FormMultiDict in Request.form to properly handle multi-keys by @provinzkraut in #3639
• fix: Small docs update. by @Zimzozaur in #3661
• fix(DTO): Inconsistent use of strict mode by @provinzkraut in #3685
• fix(prometheus): use path template for prometheus metrics by @evstratbg in #3687
• fix: OpenTelemetry doesn't capture exceptions in the outermost application layer by @provinzkraut in #3689
• fix: updated sqlalchemy samples & unpin advanced-alchemy by @cofin in #3693
• fix(#3554): correct module_to_os_path to return directory paths by @supercoder-dev in #3565
• fix: csrf middleware excluding router by @trim21 in #3698
• fix: inconsistent behavior between signature_namespace and signature_types by @cofin in #3696
• fix(JWT): Response with 401 on token payload validation by @provinzkraut in #3705

New features 🚀

• feat: switched abandonded python-jose to pyjwt by @nielsvanhooy in #3684
• feat(DTO): introduce forbid_unknown_fields config by @provinzkraut in #3690
• feat(JWT): Custom JWT payload classes by @provinzkraut in #3692
• feat(DTO): Support extra="forbid" model config for PydanticDTO by @provinzkraut in #3691
• feat(middleware): Warn about greedy exclude patterns by @provinzkraut in #3700
• feat: problem details plugin by @peterschutt in #3323
• feat(JWT): Customised token verification by @provinzkraut in #3695

Other changes

• docs: fixed bad links in flask migration guide by @jlr295 in #3660
• docs: Fix misplaced comment in dependency-injection.rst for better clarity by @Zimzozaur in #3671
• docs: Added Posting tool as an alternative to Postman in 06-receiving-data.rst by @Zimzozaur in #3670
• docs: Document custom types by @stewit in #3603
• docs: stale reference to pydantic signature models by @cofin in #3697
• docs: Fixing spelling in request.rst by @aarcex3 in #3703
• docs: fixed incorrect docs for default status code for http handler by @FarhanAliRaza in #3702

Full Changelog
v2.10.0...v2.11.0

v2.10.0

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Avra

Thanks to these incredible personal sponsors:

• Polar.sh: @Nozavi, @cemrehancavdar, @thomastu, @skewty, @iRod3s
• GitHub Sponsors: @roboflow, @benjamin-kirkbride, @crisog, @geeshta, @cbscsm, @ruslan-korneev
• OpenCollective: Christian Y, Anonymous

A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @taihim made their first contribution in #3610
• @l-armstrong made their first contribution in #3618
• @Anu-cool-007 made their first contribution in #3608
• @Murtagy made their first contribution in #3526
• @tcbegley made their first contribution in #3629
• @rafalkrupinski made their first contribution in #3575

Bugfixes 🐛

• fix(signature): Fix #3593: Ensure signature model internal function signatures don't clash with model signature by @provinzkraut in #3605
• fix(OpenAPI): Correctly handle Annotated NewType by @sherbang in #3615
• fix: use ASGIConnection instead of Request for flash by @cofin in #3626
• fix(handlers): Allow returning Response[None] from head route handlers by @provinzkraut in #3641

New features 🚀

• feat: allow creating parent directories for a file store by @Murtagy in #3526
• feat(logging): add param logging_module to LoggingConfig by @jderrien in #3578
• feat: add handler name to exceptions in handler validation. by @rafalkrupinski in #3575
• feat(Pydantic): added parameters in pydantic plugin to support strict validation and all the model_dump args by @Anu-cool-007 in #3608

Other changes

• docs: fix typos in examples.contrib.prometheus by @taihim in #3610
• docs: fixed create_ws_route_handlers typo. by @l-armstrong in #3618
• docs: fix link to available issues by @tcbegley in #3629

Full Changelog
v2.9.1...v2.10.0

v2.9.1

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Avra

A huge 'Thank you!' to all sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @PossiblePanda made their first contribution in #3555
• @eltociear made their first contribution in #3563
• @evstratbg made their first contribution in #3533

Bugfixes 🐛

• fix: add OPTIONS to the default safe methods for CSRFConfig by @wer153 in #3538
• fix(docs): fixed typo in routing overview by @PossiblePanda in #3555
• fix(prometheus): capture templated route name for metrics by @evstratbg in #3533
• fix(testing): .websocket_connect does not respect base_url by @provinzkraut in #3567
• fix(warnings): Do not warn for default handlers by @Alc-Alc in #3569
• fix(CLI): Don't call rich_click.patch if rich_click is installed by @provinzkraut in #3570
• fix(OpenAPI): Correctly handle typing.NewType by @provinzkraut in #3580
• fix: encode response content object returned from an exception handler. by @rafalkrupinski in #3585

Other changes

• docs(logging): use queue_listener as mentioned in the warning by @jderrien in #3540
• docs: Changed cli to concurrency in concurrency.rst by @PossiblePanda in #3557
• docs: update ui_plugins.rst by @eltociear in #3563
• docs(logging): advise to use log_exceptions="always" by @jderrien in #3577
• refactor(logging): improve LoggingConfig & deprecate LoggingConfig.propagate by @jderrien in #3543

Full Changelog
v2.9.0...v2.9.1

v2.9.0

Sponsors 🌟

Thanks to these incredible business sponsors:

• Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team), Bruno

Thanks to these incredible personal sponsors:

• Polar.sh: @Nozavi, @cemrehancavdar, @thomastu, @skewty, @iRod3s

• GitHub Sponsors: @benjamin-kirkbride, @crisog, @geeshta, @cbscsm, @ruslan-korneev

• OpenCollective: Christian Y, Anonymous

• A huge 'Thank you!' to all sponsors, subscribers, and contributors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @JorenSix made their first contribution in #3475
• @tibor-reiss made their first contribution in #3497
• @ch-iv made their first contribution in #3434
• @0xE111 made their first contribution in #3511
• @maintain0404 made their first contribution in #3405

Bugfixes 🐛

• fix: asgi lifespan msg after lifespan context exception by @peterschutt in #3315
• fix: bug when pydantic==1.10 is installed by @peterschutt in #3335
• fix: OpenAPI router and controller on same app. by @peterschutt in #3338
• fix: pydantic v2 import tests for pydantic v1.10.15 by @peterschutt in #3347
• fix: Remove use of asserts for control flow. by @peterschutt in #3359
• fix: schema for generic wrapped return types with DTO by @peterschutt in #3371
• fix: Ambiguous default warning for no signature default by @peterschutt in #3378
• fix: Path param consumed by dependency treated as unconsumed by @peterschutt in #3380
• fix: "name" and "in" should not be included in openapi headers by @peterschutt in #3417
• fix: top-level import of optional package by @peterschutt in #3418
• fix: regular handler under mounted app by @peterschutt in #3430
• fix: logging to file with structlog by @peterschutt in #3425
• fix: clear session cookie if new session gt CHUNK_SIZE by @peterschutt in #3446
• fix: flash messages were not displayed on Redirect by @euri10 in #3420
• fix: Validation of optional sequence in multipart data with one value by @provinzkraut in #3408
• fix(ci): adjust issue template to not allow blank issues by @JacobCoffee in #3452
• fix(pydantic v1): field not optional if default value by @peterschutt in #3476
• fix: prevent starting multiple responses by @peterschutt in #3479
• fix: logging middleware with multi-body response by @peterschutt in #3478
• fix(dto): handle dto type nested in mapping by @peterschutt in #3486
• fix: examples omitted in schema produced by dto by @peterschutt in #3510
• fix(validation): fix: handling validation of subscribed generics by @provinzkraut in #3519
• fix: exclude static file from schema by @tibor-reiss in #3509
• fix: use re.match instead of re.search for mounted app path (#3501) by @0xE111 in #3511
• fix(logging): do not log exceptions twice, deprecate traceback_line_limit and fix: pretty_print_tty by @jderrien in #3507
• fix(OpenAPI): YAML schema dump by @floxay in #3537

New features 🚀

• Add async websocket_connect to AsyncTestClient by @kedod in #3328
• Add SecretString and SecretBytes datastructures by @peterschutt in #3322

Other changes

• Deprecate subclassing route handler decorators by @provinzkraut in #3439
• Deprecate CORSMiddleware from public interface. by @peterschutt in #3404

Full Changelog
v2.8.3...v2.9.0

v2.8.3

⚠️ Important ⚠️

This release contains a patch for a vulnerability that would allow path traversal in the static file serving functionality of Litestar. It is highly recommended to update your minor version to this patch release.

You can find more background information in the related discussion #3473 .

Sponsors 🌟

Thanks to these incredible business sponsors:

Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team)

A huge 'Thank you!' to all other sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

New contributors 🎉

• @maintain0404 made their first contribution in #3405

Bugfixes 🐛

• Fix improper Limitation of a Pathname to a Restricted Directory by @peterschutt in GHSA-83pv-qr33-2vcf
• Remove use of asserts for control flow in Pydantic Plugin by @peterschutt in #3359
• Fix OpenAPI schema for generic wrapped return types with DTO by @peterschutt in #3371
• Fix ambiguous default warning for no signature default by @peterschutt in #3378
• Fix path param consumed by dependency treated as unconsumed by @peterschutt in #3380
• Fix remove name and in properties included in OpenAPI headers by @peterschutt in #3417
• Fix unconditional minijinja import in flash-messages plugin by @peterschutt in #3418
• Fix routing issues with regular handler under mounted app by @peterschutt in #3430
• Fix file logging with structlog by @peterschutt in #3425
• Fix clearing large session cookies by @peterschutt in #3446
• Fix flash messages were not displayed on redirects by @euri10 in #3420
• Fix alidation of optional sequence in multipart data with one value by @provinzkraut in #3408

Documentation

• Update usage/static_files by @JacobCoffee in #3358
• Fix broken url; swagger ui by @wer153 in #3368
• Correct a word by @wer153 in #3412
• Fix WebSockets documentation grammar by @marcuslimdw in #3413
• Fix intersphinx mapping for advanced-alchemy by @provinzkraut in #3438
• Update usage/caching by @JacobCoffee in #3345
• Update docs/usage/security/* by @JacobCoffee in #3344
• Improve sse by @euri10 in #3454

Full Changelog
v2.8.2...v2.8.3

v2.7.2

⚠️ Important ⚠️

This release contains a patch for a vulnerability that would allow path traversal in the static file serving functionality of Litestar. It is highly recommended to update your minor version to this patch release.

You can find more background information in the related discussion #3473 .

Sponsors 🌟

Thanks to these incredible business sponsors:

Scalar (@scalar), Telemetry Sports (via @chris-telemetry), Stok (@stok-team)

A huge 'Thank you!' to all other sponsors across Polar.sh, OpenCollective and GitHub Sponsors!

What's changed

• Fix improper Limitation of a Pathname to a Restricted Directory by @peterschutt in GHSA-83pv-qr33-2vcf