Sanic 24.12

Apply these rules to applications using the Sanic 24.12 LTS line after the Python baseline; they were checked against 24.12.1. Check separately installed extensions and the actual serving stack against their own versions.

Version and protocol boundary

• Lock Sanic to one exact 24.12 LTS release in the lock file and move to each new 24.12 patch release as it ships. Sanic gives LTS releases bug and security fixes for 24 months and backports them as patch releases on the LTS line, while an interim release is supported only until the next release, so an interim v24 release doesn't receive the LTS fixes.
• Use a maintained Python minor from the tag's stable 3.9–3.13 test matrix and test the application on it. Python 3.9 and 3.10 are end-of-life, which leaves 3.11–3.13. The release notes require Python 3.9 or newer despite stale python_requires >=3.8 metadata; neither that metadata nor the Python baseline establishes compatibility with newer minors.
• Preserve all four 24.12.1 security-patch behaviors: reject chunked trailers instead of reparsing them as another request, reject request-target bytes longer than 65,535, remove CR, LF, and NUL from response header names and values, and restrict Inspector action dispatch to public methods.
• Plan migration before 24.12 LTS support ends in December 2026; do not run the line after its support window.

Routes, requests, and authorization

• Build routes from trusted code with explicit methods, constrained path converters, and deliberate trailing-slash and version-prefix policies. Apply the same authorization to aliases,