Update dependency werkzeug to v3 #130

2024-09-13T13:37:00+02:00

renovate-bot commented

2024-09-13 13:37:00 +02:00

This PR contains the following updates:

Package	Change	Age	Confidence
werkzeug (changelog)	`==2.3.8` → `==3.1.8`

Release Notes

pallets/werkzeug (werkzeug)

`v3.1.8`

Compare Source

Released 2026-04-02

Request.host and get_host return the empty string if the header is
missing or has invalid characters. :issue:3142

`v3.1.7`

Compare Source

Released 2026-03-23

parse_list_header preserves partially quoted items, discards empty
items, and returns empty for unclosed quoted values. :pr:3128
WWWAuthenticate.to_header does not produce a trailing space when there
are no parameters. :issue:3127
Transfer-Encoding is parsed as a set. :pr:3134
Request.host, get_host, and host_is_trusted validate the
characters of the value. An empty value is no longer allowed. A Unix socket
server address is ignored. The trusted_list argument to
host_is_trusted is optional. :pr:3113
Fix multipart form parser handling of newline at boundary. :issue:3088
Response.make_conditional sets the Accept-Ranges header even if it
is not a satisfiable range request. :issue:3108
merge_slashes merges any number of consecutive slashes. :issue:3121

`v3.1.6`

Compare Source

Released 2026-02-19

safe_join on Windows does not allow special devices names in
multi-segment paths. :ghsa:29vq-49wr-vm6x
Response.make_conditional sets the Accept-Ranges header even if it
is not a satisfiable range request. :issue:3108

`v3.1.5`

Compare Source

Released 2026-01-08

safe_join on Windows does not allow more special device names, regardless
of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
The multipart form parser handles a \r\n sequence at a chunk boundary.
This fixes the previous attempt, which caused incorrect content lengths.
:issue:3065 :issue:3077
Fix AttributeError when initializing DebuggedApplication with
pin_security=False. :issue:3075

`v3.1.4`

Compare Source

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents
reading from these when using send_from_directory. secure_filename
already prevented writing to these. :ghsa:hgf8-39gv-g3f2
The debugger pin fails after 10 attempts instead of 11. :pr:3020
The multipart form parser handles a \r\n sequence at a chunk boundary.
:issue:3065
Improve CPU usage during Watchdog reloader. :issue:3054
Request.json annotation is more accurate. :issue:3067
Traceback rendering handles when the line number is beyond the available
source lines. :issue:3044
HTTPException.get_response annotation and doc better conveys the
distinction between WSGI and sans-IO responses. :issue:3056

`v3.1.3`

Compare Source

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts
list, tuple, or set when passing multiple values. It had been
changed to accept any Collection, but this matched types that should be
treated as single values, such as bytes. :issue:2994
When the Host header is not set and Request.host falls back to the
WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped
in [] to match the Host header. :issue:2993

`v3.1.2`

Compare Source

Released 2024-11-04

Improve type annotation for TypeConversionDict.get to allow the type
parameter to be a callable. :issue:2988
Headers does not inherit from MutableMapping, as it is does not
exactly match that interface. :issue:2989

`v3.1.1`

Compare Source

Released 2024-11-01

Fix an issue that caused str(Request.headers) to always appear empty.
:issue:2985

`v3.1.0`

Compare Source

Released 2024-10-31

Drop support for Python 3.8. :pr:2966
Remove previously deprecated code. :pr:2967
Request.max_form_memory_size defaults to 500kB instead of unlimited.
Non-file form fields over this size will cause a RequestEntityTooLarge
error. :issue:2964
OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
Use MultiDict and ImmutableMultiDict instead. :issue:2968
Behavior of properties on request.cache_control and
response.cache_control has been significantly adjusted.
- Dict values are always str | None. Setting properties will convert
  the value to a string. Setting a property to False is equivalent to
  setting it to None. Getting typed properties will return None if
  conversion raises ValueError, rather than the string. :issue:2980
- max_age is None if present without a value, rather than -1.
  :issue:2980
- no_cache is a boolean for requests, it is True instead of
  "*" when present. It remains a string for responses. :issue:2980
- max_stale is True if present without a value, rather
  than "*". :issue:2980
- no_transform is a boolean. Previously it was mistakenly always
  None. :issue:2881
- min_fresh is None if present without a value, rather than
  "*". :issue:2881
- private is True if present without a value, rather than "*".
  :issue:2980
- Added the must_understand property. :issue:2881
- Added the stale_while_revalidate, and stale_if_error
  properties. :issue:2948
- Type annotations more accurately reflect the values. :issue:2881
Support Cookie CHIPS (Partitioned Cookies). :issue:2797
Add 421 MisdirectedRequest HTTP exception. :issue:2850
Increase default work factor for PBKDF2 to 1,000,000 iterations.
:issue:2969
Inline annotations for datastructures, removing stub files.
:issue:2970
MultiDict.getlist catches TypeError in addition to ValueError
when doing type conversion. :issue:2976
Implement | and |= operators for MultiDict, Headers, and
CallbackDict, and disallow |= on immutable types. :issue:2977

`v3.0.6`

Compare Source

Released 2024-10-25

Fix how max_form_memory_size is applied when parsing large non-file
fields. :ghsa:q34m-jh98-gwm2
safe_join catches certain paths on Windows that were not caught by
ntpath.isabs on Python < 3.11. :ghsa:f9vj-2wh5-fj8j

`v3.0.5`

Compare Source

Released 2024-10-24

The Watchdog reloader ignores file closed no write events. :issue:2945
Logging works with client addresses containing an IPv6 scope :issue:2952
Ignore invalid authorization parameters. :issue:2955
Improve type annotation fore SharedDataMiddleware. :issue:2958
Compatibility with Python 3.13 when generating debugger pin and the current
UID does not have an associated name. :issue:2957

`v3.0.4`

Compare Source

Released 2024-08-21

Restore behavior where parsing multipart/x-www-form-urlencoded data with
invalid UTF-8 bytes in the body results in no form data parsed rather than a
413 error. :issue:2930
Improve parse_options_header performance when parsing unterminated
quoted string values. :issue:2904
Debugger pin auth is synchronized across threads/processes when tracking
failed entries. :issue:2916
Dev server handles unexpected SSLEOFError due to issue in Python < 3.13.
:issue:2926
Debugger pin auth works when the URL already contains a query string.
:issue:2918

`v3.0.3`

Compare Source

Released 2024-05-05

Only allow localhost, .localhost, 127.0.0.1, or the specified
hostname when running the dev server, to make debugger requests. Additional
hosts can be added by using the debugger middleware directly. The debugger
UI makes requests using the full URL rather than only the path.
:ghsa:2g68-c3qc-8985
Make reloader more robust when "" is in sys.path. :pr:2823
Better TLS cert format with adhoc dev certs. :pr:2891
Inform Python < 3.12 how to handle itms-services URIs correctly, rather
than using an overly-broad workaround in Werkzeug that caused some redirect
URIs to be passed on without encoding. :issue:2828
Type annotation for Rule.endpoint and other uses of endpoint is
Any. :issue:2836
Make reloader more robust when "" is in sys.path. :pr:2823

`v3.0.2`

Compare Source

Released 2024-04-01

Ensure setting merge_slashes to False results in NotFound for
repeated-slash requests against single slash routes. :issue:2834
Fix handling of TypeError in TypeConversionDict.get() to match
ValueError. :issue:2843
Fix response_wrapper type check in test client. :issue:2831
Make the return type of MultiPartParser.parse more precise.
:issue:2840
Raise an error if converter arguments cannot be parsed. :issue:2822

`v3.0.1`

Compare Source

Released 2023-10-24

Fix slow multipart parsing for large parts potentially enabling DoS attacks.

`v3.0.0`

Compare Source

Released 2023-09-30

Remove previously deprecated code. :pr:2768
Deprecate the __version__ attribute. Use feature detection, or
importlib.metadata.version("werkzeug"), instead. :issue:2770
generate_password_hash uses scrypt by default. :issue:2769
Add the "werkzeug.profiler" item to the WSGI environ dictionary
passed to ProfilerMiddleware's filename_format function. It contains
the elapsed and time values for the profiled request. :issue:2775
Explicitly marked the PathConverter as non path isolating. :pr:2784

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [werkzeug](https://github.com/pallets/werkzeug) ([changelog](https://werkzeug.palletsprojects.com/page/changes/)) | `==2.3.8` → `==3.1.8` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/werkzeug/3.1.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/werkzeug/2.3.8/3.1.8?slim=true) | --- ### Release Notes <details> <summary>pallets/werkzeug (werkzeug)</summary> ### [`v3.1.8`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-318) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.7...3.1.8) Released 2026-04-02 - `Request.host` and `get_host` return the empty string if the header is missing or has invalid characters. :issue:`3142` ### [`v3.1.7`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-317) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.6...3.1.7) Released 2026-03-23 - `parse_list_header` preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. :pr:`3128` - `WWWAuthenticate.to_header` does not produce a trailing space when there are no parameters. :issue:`3127` - `Transfer-Encoding` is parsed as a set. :pr:`3134` - `Request.host`, `get_host`, and `host_is_trusted` validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The `trusted_list` argument to `host_is_trusted` is optional. :pr:`3113` - Fix multipart form parser handling of newline at boundary. :issue:`3088` - `Response.make_conditional` sets the `Accept-Ranges` header even if it is not a satisfiable range request. :issue:`3108` - `merge_slashes` merges any number of consecutive slashes. :issue:`3121` ### [`v3.1.6`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-316) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.5...3.1.6) Released 2026-02-19 - `safe_join` on Windows does not allow special devices names in multi-segment paths. :ghsa:`29vq-49wr-vm6x` - `Response.make_conditional` sets the `Accept-Ranges` header even if it is not a satisfiable range request. :issue:`3108` ### [`v3.1.5`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-315) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.4...3.1.5) Released 2026-01-08 - `safe_join` on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:`87hc-h4r5-73f7` - The multipart form parser handles a `\r\n` sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:`3065` :issue:`3077` - Fix `AttributeError` when initializing `DebuggedApplication` with `pin_security=False`. :issue:`3075` ### [`v3.1.4`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-314) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.3...3.1.4) Released 2025-11-28 - `safe_join` on Windows does not allow special device names. This prevents reading from these when using `send_from_directory`. `secure_filename` already prevented writing to these. :ghsa:`hgf8-39gv-g3f2` - The debugger pin fails after 10 attempts instead of 11. :pr:`3020` - The multipart form parser handles a `\r\n` sequence at a chunk boundary. :issue:`3065` - Improve CPU usage during Watchdog reloader. :issue:`3054` - `Request.json` annotation is more accurate. :issue:`3067` - Traceback rendering handles when the line number is beyond the available source lines. :issue:`3044` - `HTTPException.get_response` annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:`3056` ### [`v3.1.3`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-313) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.2...3.1.3) Released 2024-11-08 - Initial data passed to `MultiDict` and similar interfaces only accepts `list`, `tuple`, or `set` when passing multiple values. It had been changed to accept any `Collection`, but this matched types that should be treated as single values, such as `bytes`. :issue:`2994` - When the `Host` header is not set and `Request.host` falls back to the WSGI `SERVER_NAME` value, if that value is an IPv6 address it is wrapped in `[]` to match the `Host` header. :issue:`2993` ### [`v3.1.2`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-312) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.1...3.1.2) Released 2024-11-04 - Improve type annotation for `TypeConversionDict.get` to allow the `type` parameter to be a callable. :issue:`2988` - `Headers` does not inherit from `MutableMapping`, as it is does not exactly match that interface. :issue:`2989` ### [`v3.1.1`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-311) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.0...3.1.1) Released 2024-11-01 - Fix an issue that caused `str(Request.headers)` to always appear empty. :issue:`2985` ### [`v3.1.0`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-310) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.6...3.1.0) Released 2024-10-31 - Drop support for Python 3.8. :pr:`2966` - Remove previously deprecated code. :pr:`2967` - `Request.max_form_memory_size` defaults to 500kB instead of unlimited. Non-file form fields over this size will cause a `RequestEntityTooLarge` error. :issue:`2964` - `OrderedMultiDict` and `ImmutableOrderedMultiDict` are deprecated. Use `MultiDict` and `ImmutableMultiDict` instead. :issue:`2968` - Behavior of properties on `request.cache_control` and `response.cache_control` has been significantly adjusted. - Dict values are always `str | None`. Setting properties will convert the value to a string. Setting a property to `False` is equivalent to setting it to `None`. Getting typed properties will return `None` if conversion raises `ValueError`, rather than the string. :issue:`2980` - `max_age` is `None` if present without a value, rather than `-1`. :issue:`2980` - `no_cache` is a boolean for requests, it is `True` instead of `"*"` when present. It remains a string for responses. :issue:`2980` - `max_stale` is `True` if present without a value, rather than `"*"`. :issue:`2980` - `no_transform` is a boolean. Previously it was mistakenly always `None`. :issue:`2881` - `min_fresh` is `None` if present without a value, rather than `"*"`. :issue:`2881` - `private` is `True` if present without a value, rather than `"*"`. :issue:`2980` - Added the `must_understand` property. :issue:`2881` - Added the `stale_while_revalidate`, and `stale_if_error` properties. :issue:`2948` - Type annotations more accurately reflect the values. :issue:`2881` - Support Cookie CHIPS (Partitioned Cookies). :issue:`2797` - Add 421 `MisdirectedRequest` HTTP exception. :issue:`2850` - Increase default work factor for PBKDF2 to 1,000,000 iterations. :issue:`2969` - Inline annotations for `datastructures`, removing stub files. :issue:`2970` - `MultiDict.getlist` catches `TypeError` in addition to `ValueError` when doing type conversion. :issue:`2976` - Implement `|` and `|=` operators for `MultiDict`, `Headers`, and `CallbackDict`, and disallow `|=` on immutable types. :issue:`2977` ### [`v3.0.6`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-306) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.5...3.0.6) Released 2024-10-25 - Fix how `max_form_memory_size` is applied when parsing large non-file fields. :ghsa:`q34m-jh98-gwm2` - `safe_join` catches certain paths on Windows that were not caught by `ntpath.isabs` on Python < 3.11. :ghsa:`f9vj-2wh5-fj8j` ### [`v3.0.5`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-305) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.4...3.0.5) Released 2024-10-24 - The Watchdog reloader ignores file closed no write events. :issue:`2945` - Logging works with client addresses containing an IPv6 scope :issue:`2952` - Ignore invalid authorization parameters. :issue:`2955` - Improve type annotation fore `SharedDataMiddleware`. :issue:`2958` - Compatibility with Python 3.13 when generating debugger pin and the current UID does not have an associated name. :issue:`2957` ### [`v3.0.4`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-304) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.3...3.0.4) Released 2024-08-21 - Restore behavior where parsing `multipart/x-www-form-urlencoded` data with invalid UTF-8 bytes in the body results in no form data parsed rather than a 413 error. :issue:`2930` - Improve `parse_options_header` performance when parsing unterminated quoted string values. :issue:`2904` - Debugger pin auth is synchronized across threads/processes when tracking failed entries. :issue:`2916` - Dev server handles unexpected `SSLEOFError` due to issue in Python < 3.13. :issue:`2926` - Debugger pin auth works when the URL already contains a query string. :issue:`2918` ### [`v3.0.3`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-303) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.2...3.0.3) Released 2024-05-05 - Only allow `localhost`, `.localhost`, `127.0.0.1`, or the specified hostname when running the dev server, to make debugger requests. Additional hosts can be added by using the debugger middleware directly. The debugger UI makes requests using the full URL rather than only the path. :ghsa:`2g68-c3qc-8985` - Make reloader more robust when `""` is in `sys.path`. :pr:`2823` - Better TLS cert format with `adhoc` dev certs. :pr:`2891` - Inform Python < 3.12 how to handle `itms-services` URIs correctly, rather than using an overly-broad workaround in Werkzeug that caused some redirect URIs to be passed on without encoding. :issue:`2828` - Type annotation for `Rule.endpoint` and other uses of `endpoint` is `Any`. :issue:`2836` - Make reloader more robust when `""` is in `sys.path`. :pr:`2823` ### [`v3.0.2`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-302) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.1...3.0.2) Released 2024-04-01 - Ensure setting `merge_slashes` to `False` results in `NotFound` for repeated-slash requests against single slash routes. :issue:`2834` - Fix handling of `TypeError` in `TypeConversionDict.get()` to match `ValueError`. :issue:`2843` - Fix `response_wrapper` type check in test client. :issue:`2831` - Make the return type of `MultiPartParser.parse` more precise. :issue:`2840` - Raise an error if converter arguments cannot be parsed. :issue:`2822` ### [`v3.0.1`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-301) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.0...3.0.1) Released 2023-10-24 - Fix slow multipart parsing for large parts potentially enabling DoS attacks. ### [`v3.0.0`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-300) [Compare Source](https://github.com/pallets/werkzeug/compare/2.3.8...3.0.0) Released 2023-09-30 - Remove previously deprecated code. :pr:`2768` - Deprecate the `__version__` attribute. Use feature detection, or `importlib.metadata.version("werkzeug")`, instead. :issue:`2770` - `generate_password_hash` uses scrypt by default. :issue:`2769` - Add the `"werkzeug.profiler"` item to the WSGI `environ` dictionary passed to `ProfilerMiddleware`'s `filename_format` function. It contains the `elapsed` and `time` values for the profiled request. :issue:`2775` - Explicitly marked the PathConverter as non path isolating. :pr:`2784` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit 2024-09-13 13:37:01 +02:00

Update dependency werkzeug to v3

continuous-integration/drone/pr Build is passing

Details

c09364d5a9

renovate-bot force-pushed renovate/werkzeug-3.x from c09364d5a9 to 1eb06dd4f5

2024-10-25 03:36:42 +02:00

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from 1eb06dd4f5 to 446163785d

2024-10-25 21:36:58 +02:00

Compare

renovate-bot commented

2024-10-31 18:36:24 +01:00

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Pipfile.lock

Command failed: pipenv lock
Warning: Python 3.11 was not found on your system...
Neither 'pyenv' nor 'asdf' could be found to install Python.
You can specify specific versions of Python with:
$ pipenv --python path/to/python

### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: Pipfile.lock ``` Command failed: pipenv lock Warning: Python 3.11 was not found on your system... Neither 'pyenv' nor 'asdf' could be found to install Python. You can specify specific versions of Python with: $ pipenv --python path/to/python ```

renovate-bot force-pushed renovate/werkzeug-3.x from 446163785d to 98da3047f6

2024-10-31 18:36:25 +01:00

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from 98da3047f6 to 2a57fe73a3

2024-11-01 18:36:32 +01:00

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from 2a57fe73a3 to 88de895b09

2024-11-04 18:36:36 +01:00

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from 88de895b09 to becf2734b8

2024-11-08 17:36:34 +01:00

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from becf2734b8 to f54d92daa4

2025-01-08 16:37:40 +01:00

Compare

renovate-bot added 2 commits 2025-11-29 03:37:38 +01:00

Update dependency werkzeug to v3

renovate/artifacts Artifact file update failure