URL.replace() raises IndexError when you change an authority component on a URL that has no authority. This happens for path-only URLs, where the netloc is empty.

A small reproduction:

from starlette.datastructures import URL

URL("/path").replace(port=8080)      # IndexError: string index out of range
URL("/path").replace(username="u")   # IndexError: string index out of range

The cause is in the branch that derives the existing hostname when the caller does not pass one. The netloc is empty, so after rpartition("@") the hostname is also empty, and the bracket check then indexes an empty string:

if hostname[-1] != "]":
    hostname = hostname.rsplit(":", 1)[0]

This guards that check so the split is only attempted when there is a hostname to split. A path-only URL now gains the requested component in its netloc instead of crashing, which matches what already happens when you pass hostname explicitly:

URL("/path").replace(hostname="h", port=8080)  # "//h:8080/path", already works
URL("/path").replace(port=8080)                # now "//:8080/path", was IndexError

I added assertions to the existing test_url test covering the port and username cases on a URL with no authority. The new cases fail with IndexError before the change and pass after it. ruff check and ruff format --check both pass on the touched files.