{"package":"starlette","ecosystem":"pypi","latest_version":"1.6.0","description":"The little ASGI library that shines.","license":"BSD-3-Clause","license_risk":"permissive","commercial_use_notes":"Permissive: commercial closed-source use OK; preserve the copyright notice.","homepage":"https://pypi.org/project/starlette/","repository":"https://github.com/Kludex/starlette","downloads_weekly":0,"health":{"score":73,"risk":"moderate","breakdown":{"maintenance":25,"popularity":0,"security":25,"maturity":15,"community":8},"deprecated":false,"max_score":100},"vulnerabilities":{"count":0,"critical":0,"high":0,"medium":0,"low":0,"details":[]},"versions":{"latest":"1.6.0","total_count":202,"recent":["0.49.1","0.49.2","0.49.3","0.50.0","0.51.0","0.52.0","0.52.1","1.0.0rc1","1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0"]},"metadata":{"deprecated":false,"deprecated_message":null,"maintainers_count":0,"first_published":null,"last_published":"2026-08-08T18:27:56.196765Z","dependencies_count":8,"dependencies":["anyio<5,>=3.6.2","typing-extensions>=4.10.0; python_version < \"3.13\"","httpx2>=2.0.0; extra == \"full\"","httpx<0.29.0,>=0.27.0; extra == \"full\"","itsdangerous; extra == \"full\"","jinja2; extra == \"full\"","python-multipart>=0.0.18; extra == \"full\"","pyyaml; extra == \"full\""]},"github_stats":{"stars":12580,"forks":1281,"open_issues":60,"is_archived":false,"pushed_at":"2026-08-30T13:22:00Z","subscribers_count":102},"bundle":null,"typescript":null,"known_issues":{"bugs_count":14,"bugs_severity":{"high":3,"medium":10,"low":1},"status_breakdown":{"fixed":14},"link":"/api/bugs/pypi/starlette?version=1.6.0","scope":"version","details":[{"title":"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows","severity":"high","status":"fixed","affected_version":null,"fixed_version":"1.1.0","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r"},{"title":"Starlette Denial of service (DoS) via multipart/form-data","severity":"high","status":"fixed","affected_version":null,"fixed_version":"0.40.0","url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"},{"title":"MultipartParser denial of service with too many fields or files","severity":"high","status":"fixed","affected_version":null,"fixed_version":"0.25.0","url":"https://github.com/encode/starlette/security/advisories/GHSA-74m5-2c7w-9w3x"},{"title":"PYSEC-2026-248: advisory","severity":"medium","status":"fixed","affected_version":null,"fixed_version":"1.3.0","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3"},{"title":"PYSEC-2026-2281: advisory","severity":"medium","status":"fixed","affected_version":null,"fixed_version":"1.1.0","url":"https://access.redhat.com/security/cve/CVE-2026-48818"}]},"historical_compromise":null,"recommendation":{"action":"safe_to_use","issues":[],"use_version":"1.6.0","version_hint":null,"summary":"starlette@1.6.0 is safe to use (health: 73/100)"},"version_scoped":null,"_meta":{"endpoint":"check","tier":"full","philosophy":"DepScope is free. Use the cheapest endpoint that answers your real question.","cheaper_alternatives":[{"endpoint":"/api/exists/pypi/starlette","tokens_estimated":12,"use_when":"you only need to know if the package exists (hallucination guard)"},{"endpoint":"/api/health/pypi/starlette","tokens_estimated":80,"use_when":"you only need a 0-100 score for go/no-go (>=70 = safe)"},{"endpoint":"/api/prompt/pypi/starlette","tokens_estimated":280,"use_when":"you want a plain-text LLM-friendly brief instead of JSON"},{"endpoint":"POST /api/check_bulk","tokens_estimated":60,"use_when":"you have 5+ packages to check; sends one round-trip instead of N"}],"docs":"https://depscope.dev/integrate","hint_bulk":"You've called /api/check 170 times in 60s. Save bandwidth + tokens with POST /api/check_bulk (1 round-trip for N pkgs)."},"requested_version":null,"_cache":"hit","_response_ms":0,"_powered_by":"depscope.dev — free package intelligence for AI agents","typosquat":{"is_suspected":false},"maintainer_trust":{"available":true,"bus_factor_3m":5,"active_contributors_12m":13,"primary_author_ratio":0.65,"owner_account_age_days":4386,"is_archived":false,"stars":12231,"alerts":[]},"malicious":{"is_malicious":false},"scorecard":{"available":false},"quality":{"available":true,"criticality_score":0.775,"criticality_tier":"critical","velocity_pct":-73.2,"velocity_trend":"rapid_decline","publish_security":"api_token"},"co_used_with":[{"package":"irb","occurrences":7}],"version_history_summary":{"total_versions":20,"first_release_age_days":2988,"last_release_days_ago":22,"avg_days_between_releases":157,"release_velocity":"active"}}