Update dependency Werkzeug to v3 #25
No reviewers
Labels
No labels
bug
dependencies
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
andylockran/parkrun-hackapi!25
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/werkzeug-3.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
==0.12.2→==3.1.9Release Notes
pallets/werkzeug (Werkzeug)
v3.1.9Compare Source
Released 2026-09-27
safe_joinon Windows does not allow special devices names with empty ADSmarkers on NTFS. :ghsa:
g6x2-hccm-hh4mProfilerMiddlewareusesprofiling.tracingon Python 3.15.:issue:
3207uri_to_iriandiri_to_uripreserve empty username, password, andport 0. :issue:
3189parse_options_header. :pr:3231parse_etags. :pr:3231parse_cookie. :pr:3231get_hostalso checks that the port is in the valid range. :pr:3236intURL converter returns a 404 instead of 500 error when the valueis longer than
sys.get_int_max_str_digits(). :issue:3237:issue:
3245Authorizationparsingbasicauth disallows non-base64 characters.:pr:
3248application/x-www-form-urlencodedform data is no longer limited tomax_form_memory_size, onlymax_content_length. :pr:3251LimitedStream.readintodoes not resize the buffer when it reads lessthan the remaining size. :pr:
3253correctly. :pr:
3254Rangesuffix length-0is no longer accepted. :pr:3255v3.1.8Compare Source
Released 2026-04-02
Request.hostandget_hostreturn the empty string if the header ismissing or has invalid characters. :issue:
3142v3.1.7Compare Source
Released 2026-03-23
parse_list_headerpreserves partially quoted items, discards emptyitems, and returns empty for unclosed quoted values. :pr:
3128WWWAuthenticate.to_headerdoes not produce a trailing space when thereare no parameters. :issue:
3127Transfer-Encodingis parsed as a set. :pr:3134Request.host,get_host, andhost_is_trustedvalidate thecharacters of the value. An empty value is no longer allowed. A Unix socket
server address is ignored. The
trusted_listargument tohost_is_trustedis optional. :pr:31133088Response.make_conditionalsets theAccept-Rangesheader even if itis not a satisfiable range request. :issue:
3108merge_slashesmerges any number of consecutive slashes. :issue:3121v3.1.6Compare Source
Released 2026-02-19
safe_joinon Windows does not allow special devices names inmulti-segment paths. :ghsa:
29vq-49wr-vm6xResponse.make_conditionalsets theAccept-Rangesheader even if itis not a satisfiable range request. :issue:
3108v3.1.5Compare Source
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardlessof extension or surrounding spaces. :ghsa:
87hc-h4r5-73f7\r\nsequence at a chunk boundary.This fixes the previous attempt, which caused incorrect content lengths.
:issue:
3065:issue:3077AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075v3.1.4Compare Source
Released 2025-11-28
safe_joinon Windows does not allow special device names. This preventsreading from these when using
send_from_directory.secure_filenamealready prevented writing to these. :ghsa:
hgf8-39gv-g3f23020\r\nsequence at a chunk boundary.:issue:
30653054Request.jsonannotation is more accurate. :issue:3067source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys thedistinction between WSGI and sans-IO responses. :issue:
3056v3.1.3Compare Source
Released 2024-11-08
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had beenchanged to accept any
Collection, but this matched types that should betreated as single values, such as
bytes. :issue:2994Hostheader is not set andRequest.hostfalls back to theWSGI
SERVER_NAMEvalue, if that value is an IPv6 address it is wrappedin
[]to match theHostheader. :issue:2993v3.1.2Compare Source
Released 2024-11-04
TypeConversionDict.getto allow thetypeparameter to be a callable. :issue:
2988Headersdoes not inherit fromMutableMapping, as it is does notexactly match that interface. :issue:
2989v3.1.1Compare Source
Released 2024-11-01
str(Request.headers)to always appear empty.:issue:
2985v3.1.0Compare Source
Released 2024-10-31
Drop support for Python 3.8. :pr:
2966Remove previously deprecated code. :pr:
2967Request.max_form_memory_sizedefaults to 500kB instead of unlimited.Non-file form fields over this size will cause a
RequestEntityTooLargeerror. :issue:
2964OrderedMultiDictandImmutableOrderedMultiDictare deprecated.Use
MultiDictandImmutableMultiDictinstead. :issue:2968Behavior of properties on
request.cache_controlandresponse.cache_controlhas been significantly adjusted.str | None. Setting properties will convertthe value to a string. Setting a property to
Falseis equivalent tosetting it to
None. Getting typed properties will returnNoneifconversion raises
ValueError, rather than the string. :issue:2980max_ageisNoneif present without a value, rather than-1.:issue:
2980no_cacheis a boolean for requests, it isTrueinstead of"*"when present. It remains a string for responses. :issue:2980max_staleisTrueif present without a value, ratherthan
"*". :issue:2980no_transformis a boolean. Previously it was mistakenly alwaysNone. :issue:2881min_freshisNoneif present without a value, rather than"*". :issue:2881privateisTrueif present without a value, rather than"*".:issue:
2980must_understandproperty. :issue:2881stale_while_revalidate, andstale_if_errorproperties. :issue:
29482881Support Cookie CHIPS (Partitioned Cookies). :issue:
2797Add 421
MisdirectedRequestHTTP exception. :issue:2850Increase default work factor for PBKDF2 to 1,000,000 iterations.
:issue:
2969Inline annotations for
datastructures, removing stub files.:issue:
2970MultiDict.getlistcatchesTypeErrorin addition toValueErrorwhen doing type conversion. :issue:
2976Implement
|and|=operators forMultiDict,Headers, andCallbackDict, and disallow|=on immutable types. :issue:2977v3.0.6Compare Source
Released 2024-10-25
max_form_memory_sizeis applied when parsing large non-filefields. :ghsa:
q34m-jh98-gwm2safe_joincatches certain paths on Windows that were not caught byntpath.isabson Python < 3.11. :ghsa:f9vj-2wh5-fj8jv3.0.5Compare Source
Released 2024-10-24
294529522955SharedDataMiddleware. :issue:2958UID does not have an associated name. :issue:
2957v3.0.4Compare Source
Released 2024-08-21
multipart/x-www-form-urlencodeddata withinvalid UTF-8 bytes in the body results in no form data parsed rather than a
413 error. :issue:
2930parse_options_headerperformance when parsing unterminatedquoted string values. :issue:
2904failed entries. :issue:
2916SSLEOFErrordue to issue in Python < 3.13.:issue:
2926:issue:
2918v3.0.3Compare Source
Released 2024-05-05
localhost,.localhost,127.0.0.1, or the specifiedhostname when running the dev server, to make debugger requests. Additional
hosts can be added by using the debugger middleware directly. The debugger
UI makes requests using the full URL rather than only the path.
:ghsa:
2g68-c3qc-8985""is insys.path. :pr:2823adhocdev certs. :pr:2891itms-servicesURIs correctly, ratherthan using an overly-broad workaround in Werkzeug that caused some redirect
URIs to be passed on without encoding. :issue:
2828Rule.endpointand other uses ofendpointisAny. :issue:2836""is insys.path. :pr:2823v3.0.2Compare Source
Released 2024-04-01
merge_slashestoFalseresults inNotFoundforrepeated-slash requests against single slash routes. :issue:
2834TypeErrorinTypeConversionDict.get()to matchValueError. :issue:2843response_wrappertype check in test client. :issue:2831MultiPartParser.parsemore precise.:issue:
28402822v3.0.1Compare Source
Released 2023-10-24
v3.0.0Compare Source
Released 2023-09-30
2768__version__attribute. Use feature detection, orimportlib.metadata.version("werkzeug"), instead. :issue:2770generate_password_hashuses scrypt by default. :issue:2769"werkzeug.profiler"item to the WSGIenvirondictionarypassed to
ProfilerMiddleware'sfilename_formatfunction. It containsthe
elapsedandtimevalues for the profiled request. :issue:27752784v2.3.8Compare Source
Released 2023-11-08
attacks.
v2.3.7Compare Source
Released 2023-08-14
flit_coreinstead ofsetuptoolsas build backend.27342761273427402750Acceptqvalue can be a float without a decimal part. :issue:2751v2.3.6Compare Source
Released 2023-06-08
FileStorage.content_lengthdoes not fail if the form data did not provide avalue. :issue:
2726v2.3.5Compare Source
Released 2023-06-07
2704Authorization.from_header. :issue:27172719routing.Map, a long IDNAserver_namewith a port does not failencoding. :issue:
2700iri_to_urishows a deprecation warning instead of an error when passing bytes.:issue:
2708Content-Length, only ASCIIdigits are accepted rather than any format that Python's
intandfloataccept. :issue:
2716v2.3.4Compare Source
Released 2023-05-08
Authorization.from_headerandWWWAuthenticate.from_headerdetects tokensthat end with base64 padding (
=). :issue:2685warnings.catch_warnings. :issue:2690max_form_partsrestriction from standard form data parsing and only useif for multipart content. :pr:
2694Responsewill avoid converting theLocationheader in some cases to preserveinvalid URL schemes like
itms-services. :issue:2691v2.3.3Compare Source
Released 2023-05-01
parsing speed. :issue:
2658, 2675Pathattribute is set to/by default again, to prevent clientsfrom falling back to RFC 6265's
default-pathbehavior. :issue:2672, 2679v2.3.2Compare Source
Released 2023-04-28
Expiresattribute correctly in the test client. :issue:2669max_content_lengthcan only be enforced on streaming requests if the serversets
wsgi.input_terminated. :issue:2668v2.3.1Compare Source
Released 2023-04-27
26572659pyifiles fordatastructurestype annotations. :issue:2660AuthorizationandWWWAuthenticateobjects can be compared for equality.:issue:
2665v2.3.0Compare Source
Released 2023-04-25
Drop support for Python 3.7. :pr:
2648Remove previously deprecated code. :pr:
2592Passing bytes where strings are expected is deprecated, as well as the
charsetand
errorsparameters in many places. Anywhere that was annotated, documented,or tested to accept bytes shows a warning. Removing this artifact of the transition
from Python 2 to 3 removes a significant amount of overhead in instance checks and
encoding cycles. In general, always work with UTF-8, the modern HTML, URL, and HTTP
standards all strongly recommend this. :issue:
2602Deprecate the
werkzeug.urlsmodule, except for theuri_to_iriandiri_to_urifunctions. Use theurllib.parselibrary instead. :issue:2600Update which characters are considered safe when using percent encoding in URLs,
based on the WhatWG URL Standard. :issue:
2601Update which characters are considered safe when using percent encoding for Unicode
filenames in downloads. :issue:
2598Deprecate the
safe_conversionparameter ofiri_to_uri. TheLocationheader is converted to IRI using the same process as everywhere else. :issue:
2609Deprecate
werkzeug.wsgi.make_line_iterandmake_chunk_iter. :pr:2613Use modern packaging metadata with
pyproject.tomlinstead ofsetup.cfg.:pr:
2574Request.get_json()will raise a415 Unsupported Media Typeerror if theContent-Typeheader is notapplication/json, instead of a generic 400.:issue:
2550A URL converter's
part_isolatingdefaults toFalseif itsregexcontainsa
/. :issue:2582A custom converter's regex can have capturing groups without breaking the router.
:pr:
2596The reloader can pick up arguments to
pythonlike-X dev, and does notrequire heuristics to determine how to reload the command. Only available
on Python >= 3.10. :issue:
2589The Watchdog reloader ignores file opened events. Bump the minimum version of
Watchdog to 2.3.0. :issue:
2603When using a Unix socket for the development server, the path can start with a dot.
:issue:
2595Increase default work factor for PBKDF2 to 600,000 iterations. :issue:
2611parse_options_headeris 2-3 times faster. It conforms to :rfc:9110, someinvalid parts that were previously accepted are now ignored. :issue:
1628The
is_filenameparameter tounquote_header_valueis deprecated. :pr:2614Deprecate the
extra_charsparameter and passing bytes toquote_header_value,the
allow_tokenparameter todump_header, and theclsparameter andpassing bytes to
parse_dict_header. :pr:2618Improve
parse_accept_headerimplementation. Parse according to :rfc:9110.Discard items with invalid
qvalues. :issue:1623quote_header_valuequotes the empty string. :pr:2618dump_options_headerskipsNonevalues rather than using a bare key.:pr:
2618dump_headeranddump_options_headerwill not quote a value if the key endswith an asterisk
*.parse_dict_headerwill decode values with charsets. :pr:2618Refactor the
AuthorizationandWWWAuthenticateheader data structures.:issue:
1769, :pr:2619type,parameters, andtokenattributes. Thetokenattribute supports auth schemes that use a single opaque token ratherthan
key=valueparameters, such asBearer.dictanymore, although they still implement getting,setting, and deleting
auth[key]andauth.keysyntax, as well asauth.get(key)andkey in auth.from_headerclass method.parse_authorization_headerand
parse_www_authenticate_headerare deprecated.WWWAuthenticate.set_basicandset_digestare deprecated.Instead, an instance should be created and assigned to
response.www_authenticate.response.www_authenticateto setmultiple header values. However, accessing the property only returns the first
instance.
Refactor
parse_cookieanddump_cookie. :pr:2637parse_cookieis up to 40% faster,dump_cookieis up to 60% faster.parse_cookieanddump_cookieis deprecated. Thedump_cookiecharsetparameter is deprecated.dump_cookieallowsdomainvalues that do not include a dot., andstrips off a leading dot.
dump_cookiedoes not setpath="/"unnecessarily by default.Refactor the test client cookie implementation. :issue:
1060, 1680cookie_jarattribute is deprecated.http.cookiejaris no longer usedfor storage.
domainandpathparameters default tolocalhostand/.get_cookiemethod to inspect cookies.decoded_keyanddecoded_valueattributes to match what theapp sees rather than the encoded values a client would see.
server_nameparameter toset_cookieanddelete_cookieis deprecated. Use thedomainparameter instead.delete_cookiebesidesdomain,path, andvalueare deprecated.If
request.max_content_lengthis set, it is checked immediately when accessingthe stream, and while reading from the stream in general, rather than only during
form parsing. :issue:
1513The development server, which must not be used in production, will exhaust the
request stream up to 10GB or 1000 reads. This allows clients to see a 413 error if
max_content_lengthis exceeded, instead of a "connection reset" failure.:pr:
2620The development server discards header keys that contain underscores
_, as theyare ambiguous with dashes
-in WSGI. :pr:2622secure_filenamelooks for more Windows reserved file names. :pr:2623Update type annotation for
best_matchto makedefaultparameter clearer.:issue:
2625Multipart parser handles empty fields correctly. :issue:
2632The
Mapcharsetparameter andRequest.url_charsetproperty aredeprecated. Percent encoding in URLs must always represent UTF-8 bytes. Invalid
bytes are left percent encoded rather than replaced. :issue:
2602The
Request.charset,Request.encoding_errors,Response.charset, andClient.charsetattributes are deprecated. Request and response data must alwaysuse UTF-8. :issue:
2602Header values that have charset information only allow ASCII, UTF-8, and ISO-8859-1.
:pr:
2614, 2641Update type annotation for
ProfilerMiddlewarestreamparameter.:issue:
2642Use postponed evaluation of annotations. :pr:
2644The development server escapes ASCII control characters in decoded URLs before
logging the request to the terminal. :pr:
2652The
FormDataParserparse_functionsattribute andget_parse_funcmethod,and the invalid
application/x-url-encodedcontent type, are deprecated.:pr:
2653generate_password_hashsupports scrypt. Plain hash methods are deprecated, onlyscrypt and pbkdf2 are supported. :issue:
2654v2.2.3Compare Source
Released 2023-02-14
the trailing slash is missing. :issue:
2533get_jsonspecifies that return type is not optional whensilent=False. :issue:2508parse_content_range_headerreturnsNonefor a value likebytes */-1where the length is invalid, instead of raising an
AssertionError. :issue:2531ResourceWarningrelated to the socket used byrun_simple.Remove
prepare_socket, which now happens when creating the server. :issue:2421multipart/form-datarequests with the testclient. :issue:
2549:issue:
2529LimitedStream.readworks correctly when wrapping a stream that may not returnthe requested size in one
readcall. :issue:2558=is treated as an empty key and discarded,rather than stripping the leading
==.RequestEntityTooLargeexception is raised on parsing. This mitigates a DoSattack where a larger number of form/file parts would result in disproportionate
resource use.
v2.2.2Compare Source
Released 2022-08-08
strict_slashes == Falsebehaviourwhereby leaf-requests match branch rules and vice
versa. :pr:
2489and to correctly parse
/within converter arguments. :pr:2489werkzeug.routingto use theimport assyntax for explicitly re-exporting public attributes.:pr:
24932494production deployment is always shown. :issue:
2480LocalProxy.__wrapped__is always set to the wrapped object whenthe proxy is unbound, fixing an issue in doctest that would cause it
to fail. :issue:
2485ResourceWarningrelated to the socket used byrun_simple. :issue:2421v2.2.1Compare Source
Released 2022-07-27
/path/will match a rule/pathif strictslashes mode is disabled for the rule. :issue:
2467i.e.
/2dfdoes not match/<int>. :pr:2470before more complex ones. :issue:
2471ValidationErrorto be importable fromwerkzeug.routing. :issue:2465v2.2.0Compare Source
Released 2022-07-23
get_script_name,get_query_string,peek_path_info,pop_path_info, andextract_path_info. :pr:24612461rendering HTML. :issue:
2419werkzeug.debug.preserve_contextmechanism forrestoring context-local data for a request when running code in the
debug console. :pr:
2439end_linenoand
end_col_offsetare present on AST nodes. :issue:2425needs to match a
/it must set the class variablepart_isolating = False.:pr:
2433disabled. :issue:
1074matches :rfc:
6266that the case is not relevant. :issue:2442AnyConvertervalidates the value passed for it when buildingURLs. :issue:
23883.11. :issue:
2407is_resource_modifiedandparse_cookiefunctionsbased on WSGI versions. :issue:
2408get_content_lengthfunction. :pr:24152450FileStorageacceptsos.PathLike. :pr:2418v2.1.2Compare Source
Released 2022-04-28
Transfer-Encoding: chunkedfor 1xx, 204, 304, and HEAD responses. :issue:
2375<!doctype html>and<html lang=en>. :issue:2390cache_controlattributes toFalse.:issue:
2379keep-aliveconnections in the development server, whichare not supported sufficiently by Python's
http.server.:issue:
2397v2.1.1Compare Source
Released 2022-04-01
ResponseCacheControl.s_maxageconverts its value to an int, likemax_age. :issue:2364v2.1.0Compare Source
Released 2022-03-28
Drop support for Python 3.6. :pr:
2277Using gevent or eventlet requires greenlet>=1.0 or PyPy>=7.3.7.
werkzeug.localsandcontextvarswill not work correctly witholder versions. :pr:
2278Remove previously deprecated code. :pr:
2276shutdownfunction from the WSGIenviron when running the development server. See the docs for
alternatives.
RequestandResponseclasses.useragentsmodule is removed.The
user_agentmodule provides an interface that can besubclassed to add a parser, such as ua-parser. By default it
only stores the whole string.
TestResponseinstances and can nolonger be treated as a tuple. All data is available as
properties on the response.
locals.get_identand related thread-local code fromlocals, it no longer makes sense when moving to acontextvars-based implementation.
python -m werkzeug.servingCLI.has_keymethod on some mapping datastructures; usekey in datainstead.Request.disable_data_descriptoris removed, passshallow=Trueinstead.no_etagparameter fromResponse.freeze().HTTPException.wrapclass method.cookie_datefunction. Usehttp_dateinstead.pbkdf2_hex,pbkdf2_bin, andsafe_str_cmpfunctions. Use equivalents in
hashlibandhmacmodulesinstead.
Hrefclass.HTMLBuilderclass.invalidate_cached_propertyfunction. Usedel obj.attrinstead.bind_argumentsandvalidate_arguments. Use:meth:
Signature.bindand :func:inspect.signatureinstead.detect_utf_encoding, it's built-in tojson.loads.format_string, use :class:string.Templateinstead.escapeandunescape. Use MarkupSafe instead.The
multipleparameter ofparse_options_headerisdeprecated. :pr:
2357Rely on :pep:
538and :pep:540to handle decoding file nameswith the correct filesystem encoding. The
filesystemmodule isremoved. :issue:
1760Default values passed to
Headersare validated the same wayvalues added later are. :issue:
1608Setting
CacheControlint properties, such asmax_age, willconvert the value to an int. :issue:
2230Always use
socket.fromfdwhen restarting the dev server.:pr:
2287When passing a dict of URL values to
Map.build, list values donot filter out
Noneor collapse to a single value. Passing aMultiDictdoes collapse single items. This undoes a previouschange that made it difficult to pass a list, or
Nonevalues ina list, to custom URL converters. :issue:
2249run_simpleshows instructions for dealing with "address alreadyin use" errors, including extra instructions for macOS. :pr:
2321Extend list of characters considered always safe in URLs based on
:rfc:
3986. :issue:2319Optimize the stat reloader to avoid watching unnecessary files in
more cases. The watchdog reloader is still recommended for
performance and accuracy. :issue:
2141The development server uses
Transfer-Encoding: chunkedforstreaming responses when it is configured for HTTP/1.1.
:issue:
2090, 1327, :pr:2091The development server uses HTTP/1.1, which enables keep-alive
connections and chunked streaming responses, when
threadedorprocessesis enabled. :pr:2323cached_propertyworks for classes with__slots__if acorresponding
_cache_{name}slot is added. :pr:2332Refactor the debugger traceback formatter to use Python's built-in
tracebackmodule as much as possible. :issue:1753The
TestResponse.textproperty is a shortcut forr.get_data(as_text=True), for convenient testing against textinstead of bytes. :pr:
2337safe_joinensures that the path remains relative if the trusteddirectory is the empty string. :pr:
2349Percent-encoded newlines (
%0a), which are decoded by WSGIservers, are considered when routing instead of terminating the
match early. :pr:
2350The test client doesn't set duplicate headers for
CONTENT_LENGTHand
CONTENT_TYPE. :pr:2348append_slash_redirecthandlesPATH_INFOwith internalslashes. :issue:
1972, :pr:2338The default status code for
append_slash_redirectis 308 insteadof 301. This preserves the request body, and matches a previous
change to
strict_slashesin routing. :issue:2351Fix
ValueError: I/O operation on closed file.with the testclient when following more than one redirect. :issue:
2353Response.autocorrect_location_headeris disabled by default.The
Locationheader URL will remain relative, and exclude thescheme and domain, by default. :issue:
2352Request.get_json()will raise a 400BadRequesterror if theContent-Typeheader is notapplication/json. This makes avery common source of confusion more visible. :issue:
2339v2.0.3Compare Source
Released 2022-02-07
ProxyFixsupports IPv6 addresses. :issue:2262Response.make_conditional,HTTPException.get_response, andMap.bind_to_environacceptsRequestin addition toWSGIEnvironmentfor the firstparameter. :pr:
2290Request.user_agent_class. :issue:2273LocalProxy.__class__and__doc__on an unboundproxy returns the fallback value instead of a method object.
:issue:
2188RAW_URIandREQUEST_URIcorrectly. :issue:
2151v2.0.2Compare Source
Released 2021-10-05
Connectionheader when routingWebSocket requests. :issue:
21312150MultiDict.updateto accept iterablevalues :pr:
2142merge_slash=Truefor
Rule.match. :issue:2157CombinedMultiDict.to_dictwithflat=Falseconsiders allcomponent dicts when building value lists. :issue:
2189send_fileonly sets a detectedContent-Encodingifas_attachmentis disabled to avoid browsers savingdecompressed
.tar.gzfiles. :issue:2149TypeConversionDict.getto not return anOptionalvalue if bothdefaultandtypeare notNone. :issue:2169Iterable[RuleFactory]instead ofIterable[Rule]for therulesparameter. :issue:2183FileStorage.__getattr__:issue:
2155SameSiteset toStrictinstead of
Noneto be compatible with modern browser security.:issue:
2156IO[bytes]andIO[str]instead ofBinaryIOandTextIOfor wider type compatibility.:issue:
21302158greenlet versions. :pr:
2212CallbackDict, because it is notutilizing a bound TypeVar. :issue:
22352237not expand on click for very long tracebacks. :pr:
2239not have a traceback, such as from
ProcessPoolExecutor.:issue:
2217v2.0.1Compare Source
Released 2021-05-17
send_filemax_agecallable. Don'tpass
pathlib.Pathtomax_age. :issue:2119imports in user projects. :issue:
21222123cached_propertyis generic over its return type, propertiesdecorated with it report the correct type. :issue:
2113characters. :issue:
2125headers.getwith a stringdefault will always return a string. :issue:
2128HTTPException.descriptionis not a string,get_descriptionwill convert it to a string. :issue:2115v2.0.0Compare Source
Released 2021-05-11
1693utils.format_string, use :class:string.Templateinstead. :issue:
1756utils.bind_argumentsand:func:
utils.validate_arguments, use :meth:Signature.bindand:func:
inspect.signatureinstead. :issue:1757utils.HTMLBuilder. :issue:1761utils.escapeand :func:utils.unescape, useMarkupSafe instead. :issue:
1758python -m werkzeug.servingCLI.:issue:
1834environ["werkzeug.server.shutdown"]functionthat is available when running the development server. :issue:
1752useragentsmodule and the built-in user agentparser. Use a dedicated parser library instead by subclassing
user_agent.UserAgentand settingRequest.user_agent_class.:issue:
2078posixemulationmodule. :issue:1759datetimevalues are timezone-aware withtzinfo=timezone.utc. This applies to anything usinghttp.parse_date:Request.date,.if_modified_since,.if_unmodified_since;Response.date,.expires,.last_modified,.retry_after;parse_if_range_header, andIfRange.date. When comparing values, the other values must alsobe aware, or these values must be made naive. When passing
parameters or setting attributes, naive values are still assumed to
be in UTC. :pr:
2040RequestandResponseclasses. Using the mixin classes is nolonger necessary and will show a deprecation warning. Checking
isinstanceorissubclassagainstBaseRequestandBaseResponsewill show a deprecation warning and check againstRequestorResponseinstead. :issue:1963another JSON module, override
Request.json_moduleandResponse.json_module. :pr:1766Response.get_json()no longer caches the result, and thecacheparameter is removed. :issue:1698Response.freeze()generates anETagheader if one is notset. The
no_etagparameter (which usually wasn't visibleanyway) is no longer used. :issue:
1963url_schemeargument to :meth:~routing.MapAdapter.buildto override the bound scheme. :pr:
1721build()won't append an unnecessary
?. Also drop any number ofNoneitems in a list. :issue:
1992Headersobject to a test client method orEnvironBuilder, multiple values for a key are joined into onecomma separated value. This matches the HTTP spec on multi-value
headers. :issue:
1655Response.statusandstatus_codeuses identicalparsing and error checking. :issue:
1658, :pr:1728MethodNotAllowedandRequestedRangeNotSatisfiabletake aresponsekwarg, consistent with other HTTP errors. :pr:1748~exceptions.Unauthorizedproducesone
WWW-Authenticateheader per value inwww_authenticate,rather than joining them into a single value, to improve
interoperability with browsers and other clients. :pr:
1755parse_authorization_headercan't decode the header value, itreturns
Noneinstead of raising aUnicodeDecodeError.:issue:
18161807REQUEST_URIandRAW_URI. :issue:1781default_stream_factoryto matchthe order used when calling it. :pr:
1085send_filefunction to generate a response that serves afile. Adapted from Flask's implementation. :issue:
265, :pr:1850send_from_directoryfunction to safely serve an untrustedpath within a trusted directory. Adapted from Flask's
implementation. :issue:
1880send_filetakesdownload_name, which is passed even ifas_attachment=Falseby usingContent-Disposition: inline.download_namereplaces Flask'sattachment_filename.:issue:
1869send_filesetsconditional=Trueandmax_age=Nonebydefault.
Cache-Controlis set tono-cacheifmax_ageisnot set, otherwise
public. This tells browsers to validateconditional requests instead of using a timed cache.
max_age=Nonereplaces Flask'scache_timeout=43200.:issue:
1882send_filecan be called withetag="string"to set a customETag instead of generating one.
etagreplaces Flask'sadd_etags. :issue:1868send_filesets theContent-Encodingheader if an encoding isreturned when guessing
mimetypefromdownload_name.:pr:
3896generate_password_hash. IncreasePBKDF2 iterations to 260000 from 150000. Increase salt length to 16
from 8. Use
secretsmodule to generate salt. :pr:1935sys.stdinis somehowNone.:pr:
1915delete_cookieto matchset_cookieand theattributes modern browsers expect. :pr:
1889utils.cookie_dateis deprecated, useutils.http_dateinstead. The value for
Set-Cookie expiresis no longer "-"delimited. :pr:
2040request.headersinstead ofrequest.environto look upheader attributes. :pr:
1808Clientrequest methods (client.get, etc.) alwaysreturn an instance of
TestResponse. In addition to the normalbehavior of
Response, this class providesrequestwith therequest that produced the response, and
historyto trackintermediate responses when
follow_redirectsis used.:issue:
763, 1894Clientrequest methods takes anauthparameter toadd an
Authorizationheader. It can be anAuthorizationobject or a
(username, password)tuple forBasicauth.:pr:
1809response.close()on a response from the testClientwill close the request input stream. This matches file behavior
and can prevent a
ResourceWarningin some cases. :issue:1785EnvironBuilder.from_environdecodes values encoded for WSGI, toavoid double encoding the new values. :pr:
1959non-system/virtualenv
sys.pathentries, which should containmost user code. It will also watch all Python files under
directories given in
extra_files. :pr:1945__pycache__directories again. :pr:1945run_simpletakesexclude_patternsa list offnmatchpatterns that will not be scanned by the reloader. :issue:
13336265and potentially allowed setting
__Secureprefixed cookies.:pr:
1965substring. :issue:
19231967rb+instead ofwb+mode for better compatibility with some libraries.:issue:
1961and in some tests. MD5 is not available in some environments, such
as FIPS 140. This may invalidate some caches since the ETag will be
different. :issue:
1897Cross-Origin-Opener-PolicyandCross-Origin-Embedder-Policyresponse header properties.:pr:
2008run_simpletries to show a valid IP address when binding to alladdresses, instead of
0.0.0.0or::. It also warns about notrunning the development server in production in this case.
:issue:
1964installed on Windows. For all platforms, style support no longer
requires Click. :issue:
1832return a 200 response with the empty file instead of a 416 error.
:issue:
1937RequestandResponsehave beenextracted to contain all the behavior that is not WSGI or IO
dependent. These are not a public API, they are part of an ongoing
refactor to let ASGI frameworks use Werkzeug. :pr:
2005multipart/form-datahas been refactored to use sans-iopatterns. This should also make parsing forms with large binary file
uploads significantly faster. :issue:
1788, 875LocalProxymatches the current Python data model specialmethods, including all r-ops, in-place ops, and async.
__class__is proxied, so the proxy will look like the object in more cases,
including
isinstance. Useissubclass(type(obj), LocalProxy)to check if an object is actually a proxy. :issue:
1754LocalusesContextVaron Python 3.7+ instead ofthreading.local. :pr:1778request.valuesdoes not includeformfor GET requests (eventhough GET bodies are undefined). This prevents bad caching proxies
from caching form data instead of query strings. :pr:
2037environaswerkzeug.socket. This is non-standard and specific to the devserver, other servers may expose this under their own key. It is
useful for handling a WebSocket upgrade request. :issue:
2052websocket=Truemode for WebSocket upgraderequests. :issue:
2052UserAgentParserto handle more cases. :issue:1971werzeug.DechunkedInput.readintowill not read beyond the size ofthe buffer. :issue:
20212051pbkdf2_hex,pbkdf2_bin, andsafe_str_cmpare deprecated.hashlibandhmacprovide equivalents. :pr:2083invalidate_cached_propertyis deprecated. Usedel obj.nameinstead. :pr:
2084Hrefis deprecated. Usewerkzeug.routinginstead.:pr:
2085Request.disable_data_descriptoris deprecated. Create therequest with
shallow=Trueinstead. :pr:2085HTTPException.wrapis deprecated. Create a subclass manuallyinstead. :pr:
2085v1.0.1Compare Source
Released 2020-03-31
RequestRedirect.get_responseoptional.:issue:
17181723Policy header. :pr:
1731http_datezero fills years < 1000 to always output four digits.:issue:
1739:issue:
1746io.BytesIOtoFileStorage.save. :issue:1733v1.0.0Compare Source
Released 2020-02-06
1478)(:issue:
1477)werkzeugmodule in favor of direct imports. For example, instead of
import werkzeug; werkzeug.url_quote, dofrom werkzeug.urls import url_quote. Install version 0.16 firstto see deprecation warnings while upgrading. :issue:
2, :pr:1640utils.invalidate_cached_property()to invalidate cachedproperties. (:pr:
1474)Set-Cookieresponse header are notignored when parsing the
Cookierequest header. This allowscookies with names such as "expires" and "version". (:issue:
1495)MultiDictto capture allvalues for cookies with the same key.
cookies[key]returns thefirst value rather than the last. Use
cookies.getlist(key)toget all values.
parse_cookiealso defaults to aMultiDict.:issue:
1562, :pr:1458charset=utf-8to an HTTP exception response'sCONTENT_TYPEheader. (:pr:1526)such as lambdas and comprehensions. :issue:
913, :issue:1037,:pr:
1532"opera" instead of "chrome". :issue:
1556"android" instead of "chromeos". (:pr:
1572)configured server name. :issue:
760match the current server name without the port if the current scheme
matches. :pr:
1584~exceptions.InternalServerErrorhas aoriginal_exceptionattribute that frameworks can use to track the original cause of the
error. :pr:
1590such that
X-Foois the same asx-foo. :pr:1605http.dump_cookieaccepts'None'as a value forsamesite. :issue:1549~test.Client.set_cookieaccepts asamesiteargument.:pr:
1705Response.content_security_policydata structure. :pr:1617LanguageAcceptwill fall back to matching "en" for "en-US" or"en-US" for "en" to better support clients or translations that
only match at the primary language tag. :issue:
450, :pr:1507MIMEAcceptuses MIME parameters for specificity when matching.:issue:
458, :pr:1574SSLContextconfigured to verify client certificates, the certificate in PEM
format will be available as
environ["SSL_CLIENT_CERT"].:pr:
1469is_resource_modifiedwill run for methods other thanGETandHEAD, rather than always returningFalse. :issue:409SharedDataMiddlewarereturns 404 rather than 500 when trying toaccess a directory instead of a file with the package loader. The
dependency on setuptools and pkg_resources is removed.
:issue:
1599response.cache_control.immutableflag. Keep in mind thatbrowser support for this
Cache-Controlheader option is stillexperimental and may not be implemented. :issue:
1185handled by Click instead of termcolor. :issue:
1235by cryptography instead of pyOpenSSL. :pr:
1555FileStorage.save()supportspathliband :pep:519PathLikeobjects. :issue:1653:issue:
1661host_matchingis enabled takes into accountthe current host when there are duplicate endpoints with different
hosts. :issue:
488429 TooManyRequestsand503 ServiceUnavailableHTTPexceptions takes a
retry_afterparameter to set theRetry-Afterheader. :issue:1657MapandRulehave amerge_slashesoption to collapsemultiple slashes into one, similar to how many HTTP servers behave.
This is enabled by default. :pr:
1286, 1694codes. :pr:
1678update,setlist, andsetlistdefaultmethods to theHeadersdata structure.extendmethod can takeMultiDictand kwargs. :pr:
1687, 1697rather than stripping off the first path segment. :issue:
491properties to the
RequestandResponsewrappers. :pr:1699Acceptvalues are no longer ordered alphabetically for equalquality tags. Instead the initial order is preserved. :issue:
1686Map.lock_classattribute for alternativeimplementations. :pr:
1702for use by async frameworks. :pr:
1709200, to be more compliant with :rfc:
7233. This may help servingmedia to older browsers. :issue:
410, 1704~middleware.shared_data.SharedDataMiddlewaredefaultfallback_mimetypeisapplication/octet-stream. If a filenamelooks like a text mimetype, the
utf-8charset is added to it.This matches the behavior of :class:
~wrappers.BaseResponseandFlask's
send_file(). :issue:1689v0.16.1Compare Source
Released 2020-01-27
:issue:
1663content. :issue:
1659v0.16.0Compare Source
Released 2019-09-19
Deprecate most top-level attributes provided by the
werkzeugmodule in favor of direct imports. The deprecated imports will be
removed in version 1.0.
For example, instead of
import werkzeug; werkzeug.url_quote, dofrom werkzeug.urls import url_quote. A deprecation warning willshow the correct import to use.
werkzeug.exceptionsandwerkzeug.routingshould also be imported instead of accessed,but for technical reasons can't show a warning.
:issue:
2, :pr:1640v0.15.6Compare Source
Released 2019-09-04
Windows when the script was an entry point. This fixes the issue
with Flask's
flask runcommand failing with "No module namedScripts\flask". :issue:
1614ProxyFixtrusts theX-Forwarded-Protoheader by default.:issue:
1630num_proxiesargument toProxyFixsetsx_for,x_proto, andx_hostto match 0.14 behavior. Thisis intended to make intermediate upgrades less disruptive, but the
argument will still be removed in 1.0. :issue:
1630v0.15.5Compare Source
Released 2019-07-17
TypeErrordue to changes toast.Modulein Python 3.8.:issue:
1551releases. :issue:
1553~exceptions.BadRequestKeyErroradds theKeyErrormessage to the description if
e.show_exceptionis set toTrue. This is a more secure default than the original 0.15.0behavior and makes it easier to control without losing information.
:pr:
15921581reloader to fail. :issue:
1607setuptools script installed as an egg. :issue:
1600sys.executableeven if the script ismarked executable, reverting a behavior intended for NixOS
introduced in 0.15. The reloader should no longer cause
OSError: [Errno 8] Exec format error. :issue:1482,:issue:
1580SharedDataMiddlewaresafely handles paths with Windows drivenames. :issue:
1589v0.15.4Compare Source
Released 2019-05-14
SyntaxErroron Python 2.7.5. (:issue:1544)v0.15.3Compare Source
Released 2019-05-14
Python 2.7. (:issue:
1080)responseargument to :exc:~exceptions.Unauthorized.(:pr:
1527)~exceptions.Unauthorizeddoesn't add theWWW-Authenticateheader if
www_authenticateis not given. (:issue:1516)than representing them with
b''. (:issue:1502):class:
~middleware.profiler.ProfilerMiddlewareto correctly handlefloat values. (:issue:
1511)~middleware.lint.LintMiddlewareto work on Python 3.(:issue:
1510)out in that case. (:issue:
1536)pin is now unique per container.
v0.15.2Compare Source
Released 2019-04-02
Rulecode generation uses a filename that coverage will ignore.The previous value, "generated", was causing coverage to fail.
(:issue:
1487)cookies. This fixes an issue introduced in 0.15.0 where the cookies
from the original request were used for redirects, causing functions
such as logout to fail. (:issue:
1491)prevent in-place modifications from affecting redirect requests.
(:issue:
1498)"werkzeug"logger only adds a handler if there is no handlerconfigured for its level in the logging chain. This avoids double
logging if other code configures logging first. (:issue:
1492)v0.15.1Compare Source
Released 2019-03-21
~exceptions.Unauthorizedtakesdescriptionas the firstargument, restoring previous behavior. The new
www_authenticateargument is listed second. (:issue:
1483)v0.15.0Compare Source
Released 2019-03-19
Building URLs is ~7x faster. Each :class:
~routing.Rulecompilesan optimized function for building itself. (:pr:
1281):meth:
MapAdapter.build() <routing.MapAdapter.build>can be passeda :class:
~datastructures.MultiDictto represent multiple valuesfor a key. It already did this when passing a dict with a list
value. (:pr:
724)path_infodefaults to'/'for:meth:
Map.bind() <routing.Map.bind>. (:issue:740, :pr:768,:pr:
1316)Change
RequestRedirectcode from 301 to 308, preserving the verband request body (form data) during redirect. (:pr:
1342)intandfloatconverters in URL rules will handle negativevalues if passed the
signed=Trueparameter. For example,/jump/<int(signed=True):count>. (:pr:1355)Locationautocorrection in :func:Response.get_wsgi_headers() <wrappers.BaseResponse.get_wsgi_headers>is relative to the currentpath rather than the root path. (:issue:
693, :pr:718,:pr:
1315)412 responses once again include entity headers and an error message
in the body. They were originally omitted when implementing
If-Match(:pr:1233), but the spec doesn't seem to disallow it.(:issue:
1231, :pr:1255)The Content-Length header is removed for 1xx and 204 responses. This
fixes a previous change where no body would be sent, but the header
would still be present. The new behavior matches RFC 7230.
(:pr:
1294):class:
~exceptions.Unauthorizedtakes awww_authenticateparameter to set the
WWW-Authenticateheader for the response,which is technically required for a valid 401 response.
(:issue:
772, :pr:795)Add support for status code 424 :exc:
~exceptions.FailedDependency.(:pr:
1358):func:
http.parse_cookieignores empty segments rather thanproducing a cookie with no key or value. (:issue:
1245, :pr:1301)http.parse_authorization_header(and:class:
~datastructures.Authorization,:attr:
~wrappers.Request.authorization) treats the authorizationheader as UTF-8. On Python 2, basic auth username and password are
unicode. (:pr:1325):func:
~http.parse_options_headerunderstands :rfc:2231parametercontinuations. (:pr:
1417):func:
~urls.uri_to_iridoes not unquote ASCII characters in theunreserved class, such as space, and leaves invalid bytes quoted
when decoding. :func:
~urls.iri_to_uridoes not quote reservedcharacters. See :rfc:
3987for these character classes.(:pr:
1433)get_content_typeappends a charset for any mimetype that endswith
+xml, not just those that start withapplication/.Known text types such as
application/javascriptare also givencharsets. (:pr:
1439)Clean up
werkzeug.securitymodule, remove outdated hashlibsupport. (:pr:
1282)In :func:
~security.generate_password_hash, PBKDF2 uses 150000iterations by default, increased from 50000. (:pr:
1377):class:
~wsgi.ClosingIteratorcallscloseon the wrappediterable, not the internal iterator. This doesn't affect objects
where
__iter__returnedself. For other objects, the methodwas not called before. (:issue:
1259, :pr:1260)Bytes may be used as keys in :class:
~datastructures.Headers, theywill be decoded as Latin-1 like values are. (:pr:
1346):class:
~datastructures.Rangevalidates that list of range tuplespassed to it would produce a valid
Rangeheader. (:pr:1412):class:
~datastructures.FileStoragelooks up attributes onstream._fileif they don't exist onstream, working aroundan issue where :func:
tempfile.SpooledTemporaryFiledidn'timplement all of :class:
io.IOBase. Seepython/cpython#3249. (:pr:
1409):class:
CombinedMultiDict.copy() <datastructures.CombinedMultiDict>returns a shallow mutable copy as a
:class:
~datastructures.MultiDict. The copy no longer reflectschanges to the combined dicts, but is more generally useful.
(:pr:
1420)The version of jQuery used by the debugger is updated to 3.3.1.
(:pr:
1390)The debugger correctly renders long
markupsafe.Markupinstances.(:pr:
1393)The debugger can serve resources when Werkzeug is installed as a
zip file.
DebuggedApplication.get_resourceusespkgutil.get_data. (:pr:1401)The debugger and server log support Python 3's chained exceptions.
(:pr:
1396)The interactive debugger highlights frames that come from user code
to make them easy to pick out in a long stack trace. Note that if an
env was created with virtualenv instead of venv, the debugger may
incorrectly classify some frames. (:pr:
1421)Clicking the error message at the top of the interactive debugger
will jump down to the bottom of the traceback. (:pr:
1422)When generating a PIN, the debugger will ignore a
KeyErrorraised when the current UID doesn't have an associated username,
which can happen in Docker. (:issue:
1471):class:
~exceptions.BadRequestKeyErroradds theKeyErrormessage to the description, making it clearer what caused the 400
error. Frameworks like Flask can omit this information in production
by setting
e.args = (). (:pr:1395)If a nested
ImportErroroccurs from :func:~utils.import_stringthe traceback mentions the nested import. Removes an untested code
path for handling "modules not yet set up by the parent."
(:pr:
735)Triggering a reload while using a tool such as PDB no longer hides
input. (:pr:
1318)The reloader will not prepend the Python executable to the command
line if the Python file is marked executable. This allows the
reloader to work on NixOS. (:pr:
1242)Fix an issue where
sys.pathwould change between reloads whenrunning with
python -m app. The reloader can detect that amodule was run with "-m" and reconstructs that instead of the file
path in
sys.argvwhen reloading. (:pr:1416)The dev server can bind to a Unix socket by passing a hostname like
unix://app.socket. (:pr:209, :pr:1019)Server uses
IPPROTO_TCPconstant instead ofSOL_TCPforJython compatibility. (:pr:
1375)When using an adhoc SSL cert with :func:
~serving.run_simple, thecert is shown as self-signed rather than signed by an invalid
authority. (:pr:
1430)The development server logs the unquoted IRI rather than the raw
request line, to make it easier to work with Unicode in request
paths during development. (:issue:
1115)The development server recognizes
ConnectionErroron Python 3 tosilence client disconnects, and does not silence other
OSErrorsthat may have been raised inside the application. (:pr:
1418)The environ keys
REQUEST_URIandRAW_URIcontain the rawpath before it was percent-decoded. This is non-standard, but many
WSGI servers add them. Middleware could replace
PATH_INFOwiththis to route based on the raw value. (:pr:
1419):class:
~test.EnvironBuilderdoesn't setCONTENT_TYPEorCONTENT_LENGTHin the environ if they aren't set. Previouslythese used default values if they weren't set. Now it's possible to
distinguish between empty and unset values. (:pr:
1308)The test client raises a
ValueErrorif a query string argumentwould overwrite a query string in the path. (:pr:
1338):class:
test.EnvironBuilderand :class:test.Clienttake ajsonargument instead of manually passingdataandcontent_type. This is serialized using the:meth:
test.EnvironBuilder.json_dumpsmethod. (:pr:1404):class:
test.Clientredirect handling is rewritten. (:pr:1402)redirecting to a path under the root.
ignore the body and related headers.
what browsers do.
test.EnvironBuildersets the content type and lengthheaders in addition to the WSGI keys when detecting them from
the data.
buffered=Falseto ensure iterator middleware can run cleanupcode safely. Only the last response is not buffered. (:pr:
988):class:
~test.EnvironBuilder, :class:~datastructures.FileStorage,and :func:
wsgi.get_input_streamno longer share a global_empty_streaminstance. This improves test isolation bypreventing cases where closing the stream in one request would
affect other usages. (:pr:
1340)The default
SecureCookie.serialization_methodwill change from:mod:
pickleto :mod:jsonin 1.0. To upgrade existing tokens,override :meth:
~contrib.securecookie.SecureCookie.unquoteto trypickleifjsonfails. (:pr:1413)CGIRootFixno longer modifiesPATH_INFOfor very oldversions of Lighttpd.
LighttpdCGIRootFixwas renamed toCGIRootFixin 0.9. Both are deprecated and will be removed inversion 1.0. (:pr:
1141):class:
werkzeug.wrappers.json.JSONMixinhas been replaced withFlask's implementation. Check the docs for the full API.
(:pr:
1445)The contrib modules are deprecated and will either be moved into
werkzeugcore or removed completely in version 1.0. Some modulesthat already issued deprecation warnings have been removed. Be sure
to run or test your code with
python -W default::DeprecationWarningto catch any deprecatedcode you're using. (:issue:
4)LintMiddlewarehas moved to :mod:werkzeug.middleware.lint.ProfilerMiddlewarehas moved to:mod:
werkzeug.middleware.profiler.ProxyFixhas moved to :mod:werkzeug.middleware.proxy_fix.JSONRequestMixinhas moved to :mod:werkzeug.wrappers.json.cachehas been extracted into a separate project,cachelib <https://github.com/pallets/cachelib>_. The versionin Werkzeug is deprecated.
securecookieandsessionshave been extracted into aseparate project,
secure-cookie <https://github.com/pallets/secure-cookie>_. Theversion in Werkzeug is deprecated.
fixers, exceptProxyFix, is deprecated.wrappers, exceptJSONMixin, is deprecated.atomis deprecated. This did not fit in with the rest ofWerkzeug, and is better served by a dedicated library in the
community.
jsroutingis removed. Set URLs when rendering templatesor JSON responses instead.
limiteris removed. Its specific use is handled by Werkzeugdirectly, but stream limiting is better handled by the WSGI
server in general.
testtoolsis removed. It did not offer significant benefitover the default test client.
iteriois deprecated.:func:
wsgi.get_hostno longer looks atX-Forwarded-For. Use:class:
~middleware.proxy_fix.ProxyFixto handle that.(:issue:
609, :pr:1303):class:
~middleware.proxy_fix.ProxyFixis refactored to supportmore headers, multiple values, and more secure configuration.
proxies is configured separately for each header. The
num_proxiesargument is deprecated. (:pr:1314)SERVER_NAMEandSERVER_PORTbased onX-Forwarded-Host. (:pr:1314)SERVER_PORTand modifiesHTTP_HOSTbased onX-Forwarded-Port. (:issue:1023, :pr:1304)SCRIPT_NAMEbased onX-Forwarded-Prefix.(:issue:
1237)werkzeug.proxy_fix.origkey, a dict. The individual keyswerkzeug.proxy_fix.orig_remote_addr,werkzeug.proxy_fix.orig_wsgi_url_scheme, andwerkzeug.proxy_fix.orig_http_hostare deprecated.Middleware from
werkzeug.wsgihas moved to separate modulesunder
werkzeug.middleware, along with the middleware moved fromwerkzeug.contrib. The oldwerkzeug.wsgiimports aredeprecated and will be removed in version 1.0. (:pr:
1452)werkzeug.wsgi.DispatcherMiddlewarehas moved to:class:
werkzeug.middleware.dispatcher.DispatcherMiddleware.werkzeug.wsgi.ProxyMiddlewareas moved to:class:
werkzeug.middleware.http_proxy.ProxyMiddleware.werkzeug.wsgi.SharedDataMiddlewarehas moved to:class:
werkzeug.middleware.shared_data.SharedDataMiddleware.:class:
~middleware.http_proxy.ProxyMiddlewareproxies the querystring. (:pr:
1252)The filenames generated by
:class:
~middleware.profiler.ProfilerMiddlewarecan be customized.(:issue:
1283)The
werkzeug.wrappersmodule has been converted to a package,and its various classes have been organized into separate modules.
Any previously documented classes, understood to be the existing
public API, are still importable from
werkzeug.wrappers, or maybe imported from their specific modules. (:pr:
1456)v0.14.1Compare Source
Released on December 31st 2017
development server.
v0.14Compare Source
Released on December 31st 2017
development server.
v0.13Compare Source
Released on December 7th 2017
for these versions, and support will be dropped completely in the next
version. (:issue:
pallets/meta#24)TypeErrorwhen port is not an integer. (:pr:1088)werkzeug.script. UseClick_ instead.(:pr:
1090)response.ageis parsed as atimedelta. Previously, it wasincorrectly treated as a
datetime. The header value is an integernumber of seconds, not a date string. (:pr:
414)TypeConversionDictwhere errors are not propagatedwhen using the converter. (:issue:
1102)Authorization.qopis a string instead of a set, to comply withRFC 2617. (:pr:
984)default, 4093 bytes. Browsers may silently ignore cookies larger than
this.
BaseResponsehas a new attributemax_cookie_sizeanddump_cookiehas a new argumentmax_sizeto configure this.(:pr:
780, :pr:1109)werkzeug.contrib.lint.GuardedIterator.close.(:pr:
1116)BaseResponse.calculate_content_lengthnow correctly works forUnicode responses on Python 3. It first encodes using
iter_encoded. (:issue:705)(:pr:
1205)locations to preserve lookup order. (:pr:
1197)(:pr:
1208)transfer encoding. (:pr:
1198).. _Click: https://palletsprojects.com/p/click/
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.