
Product
Introducing Reachability for PHP
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.
xpresso
Advanced tools
Xpresso is an ASGI web framework built on top of Starlette, Pydantic and di, with heavy inspiration from FastAPI.
Some of the standout features are:
Python 3.7+
pip install xpresso
You'll also want to install an ASGI server, such as Uvicorn.
pip install uvicorn
Create a file named example.py:
from pydantic import BaseModel
from xpresso import App, Path, FromPath, FromQuery
class Item(BaseModel):
item_id: int
name: str
async def read_item(item_id: FromPath[int], name: FromQuery[str]) -> Item:
return Item(item_id=item_id, name=name)
app = App(
routes=[
Path(
"/items/{item_id}",
get=read_item,
)
]
)
Run the application:
uvicorn example:app
Navigate to http://127.0.0.1:8000/items/123?name=foobarbaz in your browser. You will get the following JSON response:
{"item_id":123,"name":"foobarbaz"}
Now navigate to http://127.0.0.1:8000/docs to poke around the interactive Swagger UI documentation:

For more examples, tutorials and reference materials, see our documentation.
Xpresso is mainly inspired by FastAPI. FastAPI pioneered several ideas that are core to Xpresso's approach:
Xpresso takes these ideas and refines them by:
Annotated (PEP 593) instead of default values (param: FromQuery[str] instead of param: str = Query(...)).This project is under active development. It should not be considered "stable" or ready to be used in production. It is however ready for experimentation and learning!
Most of this APIs will be generally stable going forward, although some minor aspects like argument names will probably change at some point.
xpresso.binders): this is public, but should be considered experimental and is likely to change. The high level APIs (FromPath[str] and Annotated[str, PathParam(...)]) are likely to be stable.See this release on GitHub: v0.46.0
FAQs
A developer centric, performant Python web framework
We found that xpresso demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.

Product
Export Socket alert data to your own cloud storage in JSON, CSV, or Parquet, with flexible snapshot or incremental delivery.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.