chore: Release 2.17 (#4253)

Author: provinzkraut

.github/workflows/test.yml

@@ -56,7 +56,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v6
         with:
-          version: "0.6.12"
+          version: "0.8.8"
           enable-cache: true
 
       - name: Install dependencies

docs/_static/favicon.png

@@ -1,7 +1,83 @@
 :orphan:
 
-2.x Changelog
-=============
+Litestar 2 Changelog
+====================
+
+.. changelog:: 2.17.0
+    :date: 2025-08-09
+
+    .. change:: Fix CRLF injection vulnerability in exception logging
+        :type: bugfix
+
+        Fix a CRLF vulnerability in the exception logging where Litestar included the
+        raw request path in the logged exception, allowing potential attackers to inject
+        newlines into the log message.
+
+    .. change:: OpenAPI: Fix empty response body when using DTO and ``Response[T]`` annotation
+        :type: bugfix
+        :pr: 4158
+        :issue: 3888
+
+        Fix a bug that result in an empty response body in the OpenAPI schema when a
+        ``return_dto`` was defined on a handler with a generic ``Response`` annotation,
+        such as
+
+        .. code-block:: python
+
+            @get("/get_items", return_dto=ItemReadDTO)
+            async def get_items() -> Response[list[Item]]:
+                return Response(
+                    content=[
+                        Item(id=1, name="Item 1", secret="123"),
+                    ],
+                )
+
+
+    .. change:: OpenAPI: Ensure deterministic order of schema types
+        :type: bugfix
+        :pr: 4239
+        :issue: 3646
+
+        Fix a bug that would result in a non-deterministic ordering of ``Literal`` /
+        Enum type unions, such as ``Literal[*] | None``
+
+    .. change:: Ensure dependency cleanup of ``yield`` dependency happens in reverse order
+        :type: bugfix
+        :pr: 4246
+
+        Fix a regression in the DI system that would cause generator dependencies to
+        be cleaned up in the order they were entered, instead of the reverse order.
+
+    .. change:: OpenAPI: Add option to exclude parameter from schema
+        :type: feature
+        :pr: 4177
+
+        Add a new ``exclude_from_schema`` parameter to
+        :func:`~litestar.params.Parameter` that allows to exclude a specific parameter
+        from the OpenAPI schema.
+
+    .. change:: OpenAPI: Extend support for Pydantic's custom date(time) types
+        :type: feature
+        :pr: 4218
+        :issue: 4217
+
+        Add full OpenAPI schema support for Pydantic's custom date(time) types:
+
+        - ``PastDate``
+        - ``FutureDate``
+        - ``PastDatetime``
+        - ``FutureDatetime``
+        - ``AwareDatetime``
+        - ``NaiveDatetime``
+
+    .. change:: Make ``ReceiveRoutePlugin`` public
+        :type: feature
+        :pr: 4220
+
+        Make the previously internally used
+        :class:`litestar.plugins.ReceiveRoutePlugin` public.
+
+
 .. changelog:: 2.16.0
     :date: 2025-05-04
 

docs/_static/logo.svg

@@ -41,7 +41,7 @@ def _normalize_example_value(value: Any) -> Any:
             # UnsetType not part of the Union
             pass
 
-    value = unwrap_annotation(annotation=value, random=ExampleFactory.__random__)
+    value = unwrap_annotation(annotation=value)
     if isinstance(value, (Decimal, float)):
         value = round(float(value), 2)
     if isinstance(value, Enum):
@@ -63,7 +63,6 @@ def _create_field_meta(field: FieldDefinition) -> FieldMeta:
         annotation=field.annotation,
         default=field.default if field.default is not Empty else Null,
         name=field.name,
-        random=ExampleFactory.__random__,
     )
 
 

docs/release-notes/changelog.rst

@@ -64,7 +64,7 @@ maintainers = [
 name = "litestar"
 readme = "docs/PYPI_README.md"
 requires-python = ">=3.8,<4.0"
-version = "2.16.0"
+version = "2.17.0"
 
 [project.urls]
 Blog = "https://blog.litestar.dev"
@@ -103,7 +103,7 @@ pydantic = [
   "pydantic-extra-types!=2.9.0; python_version < \"3.9\"",
   "pydantic-extra-types; python_version >= \"3.9\"",
 ]
-redis = ["redis[hiredis]>=4.4.4"]
+redis = ["redis[hiredis]>=4.4.4,<5.3"]  # 5.3.0 introduced some issues with the channels plugin; need to investigate
 sqlalchemy = ["advanced-alchemy>=0.2.2"]
 standard = [
   "jinja2",
@@ -140,8 +140,7 @@ dev = [
   "aiosqlite",
   "asyncpg>=0.29.0",
   "psycopg[pool,binary]>=3.1.10,<3.2; python_version < \"3.13\"",
-  "psycopg[pool,c]; python_version >= \"3.13\" and sys_platform == 'linux'",
-  "psycopg[pool]; python_version >= \"3.13\" and sys_platform != 'linux'",
+  "psycopg[pool]<3.2.4; python_version >= \"3.13\"",  # Bug in 3.2.4: https://github.com/psycopg/psycopg/issues/1128
   "psycopg2-binary",
   "psutil>=5.9.8",
   "hypercorn>=0.16.0",
@@ -177,7 +176,7 @@ linting = [
 ]
 test = [
   "covdefaults",
-  "pytest",
+  "pytest==8.3.4",  # 8.4.1 causes some issues with asyncio for us; need to investigate
   "pytest-asyncio<=0.24.0; python_version < \"3.9\"",
   "pytest-asyncio>0.24.0; python_version >= \"3.9\"",
   "pytest-cov",
@@ -226,6 +225,7 @@ filterwarnings = [
   "ignore: Dropping max_length:litestar.exceptions.LitestarWarning:litestar.contrib.piccolo",
   "ignore: Python Debugger on exception enabled:litestar.exceptions.LitestarWarning:",
   "ignore: datetime.datetime.utcnow:DeprecationWarning:time_machine",
+  "ignore:Use of deprecated default '__check_model__':DeprecationWarning:polyfactory:",
 ]
 markers = [
   "sqlalchemy_integration: SQLAlchemy integration tests",

litestar/_openapi/schema_generation/examples.py

@@ -29,27 +29,28 @@ def structlog_reset() -> Iterator[None]:
 def test_structlog_to_file(tmp_path: Path) -> None:
     log_file = tmp_path / "log.log"
 
-    logging_config = StructlogConfig(
-        structlog_logging_config=StructLoggingConfig(
-            logger_factory=structlog.WriteLoggerFactory(file=log_file.open("wt")),
-            processors=default_structlog_processors(
-                json_serializer=lambda v, **_: str(default_json_serializer(v), "utf-8")
+    with log_file.open("wt") as file_handle:
+        logging_config = StructlogConfig(
+            structlog_logging_config=StructLoggingConfig(
+                logger_factory=structlog.WriteLoggerFactory(file=file_handle),
+                processors=default_structlog_processors(
+                    json_serializer=lambda v, **_: str(default_json_serializer(v), "utf-8")
+                ),
             ),
-        ),
-    )
+        )
 
-    logger = structlog.get_logger()
+        logger = structlog.get_logger()
 
-    @get("/")
-    def handler() -> str:
-        logger.info("handled", hello="world")
-        return "hello"
+        @get("/")
+        def handler() -> str:
+            logger.info("handled", hello="world")
+            return "hello"
 
-    app = Litestar(route_handlers=[handler], plugins=[StructlogPlugin(config=logging_config)], debug=True)
+        app = Litestar(route_handlers=[handler], plugins=[StructlogPlugin(config=logging_config)], debug=True)
 
-    with TestClient(app) as client:
-        resp = client.get("/")
-        assert resp.text == "hello"
+        with TestClient(app) as client:
+            resp = client.get("/")
+            assert resp.text == "hello"
 
     logged_data = [json.loads(line) for line in log_file.read_text().splitlines()]
     assert logged_data == [

pyproject.toml

@@ -1,23 +1,11 @@
-import importlib
-import sys
 from typing import TYPE_CHECKING
-from unittest.mock import MagicMock
 
 import pytest
 
-from tests.unit.test_cli import CREATE_APP_FILE_CONTENT
-from tests.unit.test_cli.conftest import CreateAppFileFixture
-
-try:
-    from rich_click import group
-except ImportError:
-    from click import group  # type:ignore[no-redef]
-
-import litestar.cli._utils
-import litestar.cli.main
-from litestar import Litestar
 from litestar.cli._utils import _format_is_enabled
 from litestar.cli.main import litestar_group as cli_command
+from tests.unit.test_cli import CREATE_APP_FILE_CONTENT
+from tests.unit.test_cli.conftest import CreateAppFileFixture
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -64,34 +52,6 @@ def test_info_command_with_app_dir(
     mock.assert_called_once()
 
 
-@pytest.mark.xdist_group("cli_autodiscovery")
-def test_register_commands_from_entrypoint(mocker: "MockerFixture", runner: "CliRunner", app_file: "Path") -> None:
-    mock_command_callback = MagicMock()
-
-    @group()
-    def custom_group() -> None:
-        pass
-
-    @custom_group.command()
-    def custom_command(app: Litestar) -> None:
-        mock_command_callback()
-
-    mock_entry_point = MagicMock()
-    mock_entry_point.load = lambda: custom_group
-    if sys.version_info < (3, 10):
-        mocker.patch("importlib_metadata.entry_points", return_value=[mock_entry_point])
-    else:
-        mocker.patch("importlib.metadata.entry_points", return_value=[mock_entry_point])
-
-    importlib.reload(litestar.cli._utils)
-    cli_command = importlib.reload(litestar.cli.main).litestar_group
-
-    result = runner.invoke(cli_command, f"--app={app_file.stem}:app custom-group custom-command")
-
-    assert result.exit_code == 0
-    mock_command_callback.assert_called_once()
-
-
 @pytest.mark.xdist_group("cli_autodiscovery")
 @pytest.mark.parametrize("invalid_app", ["invalid", "info_with_app_dir"])
 def test_incorrect_app_argument(

tests/e2e/test_logging/test_structlog_to_file.py

@@ -240,11 +240,8 @@ async def handler(request: Request) -> bytes:
         response = client.post("/")
         assert response.json() == {"body": ""}
 
-        response = client.post("/", json={"a": "123"})
-        assert response.json() == {"body": '{"a":"123"}'}
-
-        response = client.post("/", content="abc")
-        assert response.json() == {"body": "abc"}
+        response = client.post("/", content="foo")
+        assert response.json() == {"body": "foo"}
 
 
 def test_request_stream() -> None:
@@ -259,9 +256,6 @@ async def handler(request: Request) -> bytes:
         response = client.post("/")
         assert response.json() == {"body": ""}
 
-        response = client.post("/", json={"a": "123"})
-        assert response.json() == {"body": '{"a":"123"}'}
-
         response = client.post("/", content="abc")
         assert response.json() == {"body": "abc"}