chore: migrate tests to starlette 1.x TestClient; lift starlette<1.0 constraint

[t41372]

Pulls the httpx2 migration forward from its 2026-09 revisit date to clear all 5 open Dependabot alerts (2 high / 2 medium / 1 low — all starlette, all fixed in ≥1.3.1).

What blocked the fix

Our own documented dev-only constraint: [tool.uv] constraint-dependencies = ["starlette<1.0"], because starlette 1.x's TestClient runs on the httpx2 transport while our server tests used the classic httpx one.

What the migration actually required

Less than feared: the TestClient API surface is identical under httpx2 — the real change was import httpx → import httpx2 plus 49 httpx.Response type annotations in tests/test_server.py. Assertions untouched.

Changes

• pyproject: test dep httpx>=0.28 → httpx2>=2.0; security floors: starlette>=1.3.1 declared directly in [server] (all 5 GHSAs are fixed only on the 1.x line, no 0.x backports — a vulnerable pin now fails at resolve time instead of installing a silently vulnerable server) and fastapi floor 0.118 → 0.133 in both the test group and the [server] extra (0.133 is the first release to drop FastAPI's own starlette<1.0.0 cap, i.e. the lowest fastapi that can coexist with the patched line; it subsumes the historically-verified 0.118 multipart floor). Removed the constraint + the two obsolete filterwarnings ignores (suite runs warning-clean without them, under filterwarnings=error).
• uv.lock: starlette 0.52.1 → 1.3.1; httpx/httpcore removed; httpx2 2.5.0, httpcore2 2.5.0 and truststore added; fastapi stays 0.136.3.
• docs/compatibility-advisories.md: starlette advisory moved to Resolved with the lifting PR linked, the 5 GHSA ids + first-patched versions recorded, and a dated correction note for the originally mis-recorded failure mode (the Active list is now empty); stale references in CONTRIBUTING.md / dependabot.yml updated.

Verification

ruff clean · pyright 0 errors (full project) · pytest 1722 passed, 100% line+branch · lower-bounds lane simulated locally (--resolution lowest-direct, py3.10 → fastapi 0.133.0 + starlette 1.3.1 + httpx2 2.0.0): 1722 passed, 100% · uv lock --check passes.

Summary by CodeRabbit

• Bug Fixes

  • Updated dependency support to better align server and test tooling with the latest Starlette-compatible client behavior.
  • Removed an outdated compatibility restriction so current versions can be used more smoothly.

• Documentation

  • Clarified dependency guidance in contributor docs.
  • Updated compatibility advisories to show one previously active version cap as resolved, with clearer notes on why it existed and how it was retired.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR removes the pinned Starlette <1.0 upper-bound constraint, bumps FastAPI minimum versions for test and server dependency groups, migrates the test suite's HTTP client from httpx to httpx2, removes obsolete deprecation warning filters, and updates dependency-policy documentation to record the resolved advisory.

Changes

Starlette Cap Removal and httpx2 Migration

Layer / File(s)	Summary
Dependency and warning-filter updates pyproject.toml	Removes the tool.uv Starlette <1.0 constraint, bumps fastapi minimums to 0.133 in test and server dependency groups, replaces httpx>=0.28 with httpx2>=2.0, and drops two obsolete DeprecationWarning filter entries.
Test suite migration to httpx2 tests/test_server.py	Replaces the httpx import with httpx2 and updates all httpx.Response type annotations to httpx2.Response across REST endpoint tests, plus an updated comment about Content-Length behavior.
Dependency policy and advisory documentation docs/compatibility-advisories.md, CONTRIBUTING.md, .github/dependabot.yml	Moves the starlette < 1.0 advisory from active to resolved with a resolution date and details, clarifies the constraint-dependencies policy wording, and reflows the dependabot capped-dep comment.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• standard-voice/standard_asr#13: Both PRs update .github/dependabot.yml's uv policy documentation around how capped dependency constraints like starlette < 1.0 should be treated.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: migrating tests to Starlette 1.x TestClient and removing the starlette<1.0 constraint.
Description check	✅ Passed	The description covers the PR purpose and verification details, but it does not follow the exact template sections like Related Issues and Checklist.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/httpx2-starlette

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

uv.lock

Package	Version	License	Issue Type
httpcore2	2.5.0	Null	Unknown License
httpx2	2.5.0	Null	Unknown License
starlette	1.3.1	Null	Unknown License

Allowed Licenses:

0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, BSL-1.0, CC0-1.0, CC-BY-4.0, ISC, MIT, MPL-2.0, PSF-2.0, Python-2.0, Unlicense, Zlib

OpenSSF Scorecard

Package	Version	Score	Details
pip/httpcore2	2.5.0	Unknown	Unknown
pip/httpx2	2.5.0	Unknown	Unknown
pip/starlette	1.3.1	Unknown	Unknown
pip/truststore	0.10.4	Unknown	Unknown

Scanned Files

• uv.lock

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	starlette@​0.52.1 ⏵ 1.3.1		+25
	httpx2@​2.5.0

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[t41372]

@coderabbitai review

[coderabbitai]

Action performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pyproject.toml`:
- Around line 67-75: The dependency note in pyproject.toml overstates the
verified multipart behavior by claiming the fastapi>=0.118 floor and 0.116 422
regression without a source. Remove that unsupported claim from the surrounding
comment near the httpx2/fastapi dependency entries, or replace it with a
documented, verifiable reference; keep the Starlette 1.x and fastapi>=0.133
explanation intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ddbfcb67-9979-47c3-8799-e547fd8c0177

📥 Commits

Reviewing files that changed from the base of the PR and between 2718fb3 and 8ff3a60.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/dependabot.yml
• CONTRIBUTING.md
• docs/compatibility-advisories.md
• pyproject.toml
• tests/test_server.py

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

{}