[joakimnordling]

Switches the project from Poetry to uv, brings the tooling and the bundled docs UIs up
to date, and fixes the asset URLs of an app that is served under a prefix.

The commits are each self-contained and worth reading on their own.

Packaging

• Poetry -> uv. pyproject.toml is now PEP 621 with the uv_build backend,
  poetry.lock becomes uv.lock, and .python-version pins 3.11, the lowest supported
  version, for local development. skjold could only read poetry.lock, so uv audit
  took over the vulnerability scan in invoke test.
• black + isort + flake8 -> ruff. setup.cfg is gone, with the pytest and mypy
  configuration moved into pyproject.toml. The reformatting was almost a no-op; the
  only code changes were Optional[str] -> str | None and List -> list.
• The per-version Python classifiers are listed explicitly (3.11 through 3.15), as
  uv_build publishes only what pyproject.toml lists.
• src/ layout, tests outside the package. The tests can now only import the
  installed package, never the source tree via the current directory, so they exercise
  what actually ships: a static file missing from the wheel fails the suite instead of
  passing locally. The wheel no longer contains the tests, which the Poetry build did
  ship (they are in the 0.2.0 wheel on PyPI); the sdist keeps them.

Verified that the built wheel still carries all eight static files, and that the test
suite passes against the wheel installed in an isolated environment, from outside the
repository.

Dependencies and tooling

• The tests use httpx2. fastapi.testclient.TestClient is what needs httpx here,
  and starlette 1.7 deprecates plain httpx in its test client, which warned on every
  test run. The test client only understands httpx2 from starlette 1.2, and FastAPI
  capped starlette below that until 0.133.0, so the lowest supported FastAPI moves
  from 0.109.1 to 0.133.0. That is also the lowest FastAPI that allows a starlette
  with the CVE-2026-54283 fix (1.3.1); every earlier one pins starlette below 1.0.
• Python 3.10 is no longer supported. It reached its end of life on 2026-10-01, so
  the floor is now 3.11, in requires-python, the classifiers, the CI matrix and
  .python-version. The lock no longer needs the exceptiongroup and tomli
  backports.
• Python 3.15 is supported. It has its classifier and a job in the CI matrix.
• uv 0.13 is required, the first release that knows Python 3.15.0:
  required-version is >=0.13, and [build-system] allows uv_build 0.13 (no
  configuration changes).
• GitHub Actions updated to their latest releases, still SHA-pinned. The checkouts
  also stop persisting the GitHub token for the later steps of the job, which neither
  workflow needs.
• pre-commit hooks updated: pre-commit-hooks v6.0.0, ruff-pre-commit v0.17.0,
  uv-pre-commit 0.13.0. Prettier stays on mirrors-prettier v2.7.1 deliberately:
  pre-commit autoupdate wants to move it to a prettier 4 alpha.
• The dev dependency floors now match what the lock resolves to, rather than the Poetry
  constraints they were, most of which were a major version behind.
• Swagger UI 5.19.0 -> 5.33.1 and ReDoc 2.4.0 -> 2.5.4, fetched with
  uv run update-fastapi-standalone-docs. FastAPI's own docs.py points at
  swagger-ui-dist@5 and redoc@2, so these are the versions it serves from the CDNs.
  Checked the files byte-for-byte against those pinned versions, and confirmed the ReDoc
  logo patch still applies: the bundle has no reference left to cdn.redoc.ly.

Fixes #11

An app mounted inside another app is served under a prefix it has no way of knowing:
mount() doesn't touch its root_path, and the prefix only arrives with each request,
in the ASGI scope. The asset URLs were built without it, so the docs of a mounted app
asked the outer app for swagger-ui.css and got a 404.

The functions this library patches don't get the request. FastAPI does build the
openapi_url it passes them out of the request's root_path and the app's own
openapi_url, though, so removing the latter leaves the prefix to build the URLs with.
Being per request, this also covers a proxy that varies the root_path.

Note that the fix suggested in the issue, self.app.root_path, does not cover the case
the issue describes: mount() never sets that attribute, so it stays empty for a mounted
app. It does cover an app given an explicit root_path, which was broken too and is
fixed by the same change here.

Five new tests: the mounted app for both UIs, an explicit root_path, a caller-supplied
favicon URL (used as-is, as it may point anywhere), and StandaloneDocs on both a main app
and an app mounted inside it, which now works as long as they agree on their settings.
The README's disclaimer says what "agree" means, which it did not spell out before:
docs_url, redoc_url and openapi_url are FastAPI settings, so the old wording could
be satisfied and still break.

Version

Bumped to 0.3.0 rather than a patch release: raising the FastAPI floor and dropping
Python 3.10 both leave users behind.

Checked

uv run invoke test is green on all counts: every pre-commit hook, mypy, 15 tests, and
uv audit. The tests and mypy also pass on Python 3.15. Both UIs were also opened in a
browser, with and without with_google_fonts, and with the app mounted under a prefix:
every request goes to localhost, and the only external reference anywhere is the Google
Fonts stylesheet that with_google_fonts=True is meant to add.

🤖 Generated with Claude Code