[dependabot]

Bumps python-multipart from 0.0.32 to 0.0.33.

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33

• Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
• Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
• UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
• Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
• parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

• Faster opening boundary matching (#328). Complete boundaries are matched in one step.
• Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
• Faster querystring callback dispatch (#316).

🐍 Python support

• Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
• Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

• Drop Python 3.10 support #329.
• Add Python 3.15 support #350.
• Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
• Normalize the content type returned by parse_options_header when the header has parameters #287.
• Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
• Keep only the incomplete escape when quoted-printable data is split across writes #355.
• Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
• Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
• Speed up parser state lookups #330.
• Speed up opening boundary matching #328.
• Speed up querystring callback dispatch #316.

Commits

• 9217f26 Bump version to 0.0.33 (#357)
• d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
• 44871df Handle nameless uploads when keeping the filename or extension (#343)
• b21ea59 Add streaming field limits to FormParser (#333)
• 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
• 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
• 95f6376 Use the shared security policy (#353)
• 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
• d7af81c Rewrite README for newcomers (#351)
• b035d14 Add Python 3.15 classifier (#350)
• Additional commits viewable in compare view