build(deps): bump the pip group across 3 directories with 10 updates by dependabot[bot] · Pull Request #11664 · fluent/fluent-bit

dependabot · 2026-04-03T05:05:19Z

Bumps the pip group with 1 update in the /lib/wasm-micro-runtime-WAMR-2.4.1/build-scripts directory: requests.
Bumps the pip group with 3 updates in the /lib/wasm-micro-runtime-WAMR-2.4.1/tests/fuzz/wasm-mutator-fuzz/server directory: flask, flask-cors and werkzeug.
Bumps the pip group with 9 updates in the /tests/integration directory:

Package	From	To
requests	`2.32.3`	`2.33.0`
flask	`3.0.3`	`3.1.3`
werkzeug	`3.0.3`	`3.1.6`
certifi	`2024.6.2`	`2024.7.4`
deepdiff	`7.0.1`	`8.6.2`
jinja2	`3.1.4`	`3.1.6`
protobuf	`4.25.3`	`5.29.6`
urllib3	`2.2.2`	`2.6.3`
waitress	`3.0.0`	`3.0.1`

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates flask from 1.1.4 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

3.0.3

... (truncated)

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates flask-cors from 3.0.10 to 6.0.0

Release notes

Sourced from flask-cors's releases.

6.0.0

Breaking

Path specificity ordering has changed to improve specificity. This may break users who expected the previous incorrect ordering.

[CVE-2024-6839] Sort Paths by Regex Specificity by @adrianosela in corydolphin/flask-cors#391

[CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote by @adrianosela in corydolphin/flask-cors#389

What's Changed

[CVE-2024-6866] Case Sensitive Request Path Matching by @adrianosela in corydolphin/flask-cors#390

Full Changelog: corydolphin/flask-cors@5.0.1...6.0.0

5.0.1

What's Changed

This primarily changes packaging to use uv and a new release pipeline, along with some small documentation improvements

[Docs] Fix links to documentation by @coren-frankel in corydolphin/flask-cors#369

Fix minor typos by @kkirsche in corydolphin/flask-cors#371

Migrate packaging and environment management to use uv by @corydolphin in corydolphin/flask-cors#377

Fix release pipeline by @corydolphin in corydolphin/flask-cors#378

Always use trusted publishing by @corydolphin in corydolphin/flask-cors#379

Workaround license publishing issue by @corydolphin in corydolphin/flask-cors#380

Fix packaging: missing source files by @corydolphin in corydolphin/flask-cors#381

New Contributors

@coren-frankel made their first contribution in corydolphin/flask-cors#369

@kkirsche made their first contribution in corydolphin/flask-cors#371

Full Changelog: corydolphin/flask-cors@5.0.0...5.0.01

5.0.0

What's Changed

Breaking: Change default to disable private network access by @corydolphin in corydolphin/flask-cors#368 This effectively resolves GHSA-hxwh-jpp2-84pm https://osv.dev/vulnerability/PYSEC-2024-71

Full Changelog: corydolphin/flask-cors@4.0.2...5.0.0

4.0.2

What's Changed

Bump requests from 2.31.0 to 2.32.0 in /docs by @dependabot in corydolphin/flask-cors#358

Backwards Compatible Fix for CVE-2024-6221 by @adrianosela in corydolphin/flask-cors#363

Add unit tests for Private-Network by @corydolphin in corydolphin/flask-cors#367

New Contributors

@dependabot made their first contribution in corydolphin/flask-cors#358

@adrianosela made their first contribution in corydolphin/flask-cors#363

Full Changelog: corydolphin/flask-cors@4.0.1...4.0.2

... (truncated)

Changelog

Sourced from flask-cors's changelog.

Change Log

4.0.1

Security

Address CVE-2024-1681 which is a log injection vulnerability when the log level is set to debug by @aneshujevic in corydolphin/flask-cors#351

4.0.0

Remove support for Python versions older than 3.8 by @WAKayser in corydolphin/flask-cors#330

Add GHA tooling by @corydolphin in corydolphin/flask-cors#331

3.1.01

Include examples to specify that schema and port must be included in … by @YPCrumble in corydolphin/flask-cors#294

two small changes to the documentation, based on issue #290 by @bbbart in corydolphin/flask-cors#291

Fix typo by @sunarch in corydolphin/flask-cors#304

FIX: typo in CSRF by @sattamjh in corydolphin/flask-cors#315

Test against recent Python versions by @pylipp in corydolphin/flask-cors#314

Correct spelling mistakes by @EdwardBetts in corydolphin/flask-cors#311

'Access-Control-Allow-Private-Network = true' header for http response by @chelo-kjml in corydolphin/flask-cors#318

docs: Fix a few typos by @timgates42 in corydolphin/flask-cors#323

[Docs] Fix typo in configuration documentation by @sachit-shroff in corydolphin/flask-cors#316

Commits

35d8753 [CVE-2024-6844] Replace use of (urllib) unquote_plus with unquote for paths (...
e970988 [CVE-2024-6839] Sort Paths by Regex Specificity (#391)
eb39516 [CVE-2024-6866] Case Sensitive Request Path Matching (#390)
5da9be4 Fix packaging: missing source files (#381)
65a5132 Workaround license publishing issue (#380)
7127e7e Always use trusted publishing (#379)
01e2e68 Fix release pipeline (#378)
ade65a1 Major Packaging Refactor: migrate to uv (#377)
eb44bff fix: typos (#371)
1225e78 replace documentation links in README (#369)
Additional commits viewable in compare view

Updates werkzeug from 1.0.1 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1

Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. #2994

When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. #2993

3.1.2

This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.1.6

Released 2026-02-19

safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x

Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. :issue:3075

Version 3.1.4

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. :ghsa:hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. :pr:3020

The multipart form parser handles a \r\n sequence at a chunk boundary. :issue:3065

Improve CPU usage during Watchdog reloader. :issue:3054

Request.json annotation is more accurate. :issue:3067

Traceback rendering handles when the line number is beyond the available source lines. :issue:3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056

Version 3.1.3

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts

... (truncated)

Commits

04da1b5 release version 3.1.6
f407712 Merge commit from fork
f54fe98 safe_join prevents Windows special device names in multi-segment paths
d005985 start version 3.1.6
8565c2c document rule priority (#3102)
3febc7e document rule priority
2525b82 remove state machine docs
4abfbd5 rewrite build docstring (#3097)
161c18b rewrite build docstring
86e11c2 release version 3.1.5 (#3085)
Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates flask from 3.0.3 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

3.0.3

... (truncated)

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates werkzeug from 3.0.3 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: ...
Description has been truncated

Bumps the pip group with 1 update in the /lib/wasm-micro-runtime-WAMR-2.4.1/build-scripts directory: [requests](https://github.com/psf/requests). Bumps the pip group with 3 updates in the /lib/wasm-micro-runtime-WAMR-2.4.1/tests/fuzz/wasm-mutator-fuzz/server directory: [flask](https://github.com/pallets/flask), [flask-cors](https://github.com/corydolphin/flask-cors) and [werkzeug](https://github.com/pallets/werkzeug). Bumps the pip group with 9 updates in the /tests/integration directory: | Package | From | To | | --- | --- | --- | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` | | [flask](https://github.com/pallets/flask) | `3.0.3` | `3.1.3` | | [werkzeug](https://github.com/pallets/werkzeug) | `3.0.3` | `3.1.6` | | [certifi](https://github.com/certifi/python-certifi) | `2024.6.2` | `2024.7.4` | | [deepdiff](https://github.com/qlustered/deepdiff) | `7.0.1` | `8.6.2` | | [jinja2](https://github.com/pallets/jinja) | `3.1.4` | `3.1.6` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `4.25.3` | `5.29.6` | | [urllib3](https://github.com/urllib3/urllib3) | `2.2.2` | `2.6.3` | | [waitress](https://github.com/Pylons/waitress) | `3.0.0` | `3.0.1` | Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.4...v2.33.0) Updates `flask` from 1.1.4 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.4...3.1.3) Updates `flask-cors` from 3.0.10 to 6.0.0 - [Release notes](https://github.com/corydolphin/flask-cors/releases) - [Changelog](https://github.com/corydolphin/flask-cors/blob/main/CHANGELOG.md) - [Commits](corydolphin/flask-cors@3.0.10...6.0.0) Updates `werkzeug` from 1.0.1 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@1.0.1...3.1.6) Updates `requests` from 2.32.3 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.4...v2.33.0) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.4...3.1.3) Updates `werkzeug` from 3.0.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@1.0.1...3.1.6) Updates `certifi` from 2024.6.2 to 2024.7.4 - [Commits](certifi/python-certifi@2024.06.02...2024.07.04) Updates `deepdiff` from 7.0.1 to 8.6.2 - [Release notes](https://github.com/qlustered/deepdiff/releases) - [Changelog](https://github.com/qlustered/deepdiff/blob/master/CHANGELOG.md) - [Commits](qlustered/deepdiff@7.0.1...8.6.2) Updates `jinja2` from 3.1.4 to 3.1.6 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.1.4...3.1.6) Updates `protobuf` from 4.25.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `urllib3` from 2.2.2 to 2.6.3 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.2.2...2.6.3) Updates `waitress` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/Pylons/waitress/releases) - [Changelog](https://github.com/Pylons/waitress/blob/main/CHANGES.txt) - [Commits](Pylons/waitress@v3.0.0...v3.0.1) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: flask-cors dependency-version: 6.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: certifi dependency-version: 2024.7.4 dependency-type: direct:production dependency-group: pip - dependency-name: deepdiff dependency-version: 8.6.2 dependency-type: direct:production dependency-group: pip - dependency-name: jinja2 dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.6.3 dependency-type: direct:production dependency-group: pip - dependency-name: waitress dependency-version: 3.0.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b15d480e2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-03T05:08:48Z

tests/integration/requirements.txt

+deepdiff==8.6.2
 Deprecated==1.2.14
-Flask==3.0.3
+Flask==3.1.3


Align Blinker pin with Flask 3.1 requirement

Upgrading this file to Flask==3.1.3 without also updating the existing blinker==1.8.2 pin makes the integration environment unsatisfiable, because Flask 3.1 requires Blinker >= 1.9. In practice, tests/integration/setup-venv.sh installs this requirements file directly, so pip install -r requirements.txt will fail before any integration test can run.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-03T05:08:48Z

lib/wasm-micro-runtime-WAMR-2.4.1/tests/fuzz/wasm-mutator-fuzz/server/requirements.txt

@@ -1,10 +1,10 @@
-Flask==1.1.4
+Flask==3.1.3


Keep Flask pin compatible with flask-script tooling

Bumping to Flask==3.1.3 here breaks the fuzz server's migration workflow, because this environment still depends on flask-script==2.0.6 and app/manager.py uses flask_script.Manager / MigrateCommand. That stack is based on pre-Flask-2 internals, so running the documented python3 app/manager.py db ... commands will fail at startup unless Flask is kept on a compatible version or the migration tooling is modernized.

Useful? React with 👍 / 👎.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 3, 2026

dependabot bot requested a review from edsiper as a code owner April 3, 2026 05:05

dependabot bot added the dependencies Pull requests that update a dependency file label Apr 3, 2026

dependabot bot requested a review from cosmo0920 as a code owner April 3, 2026 05:05

dependabot bot added the python Pull requests that update Python code label Apr 3, 2026

dependabot bot mentioned this pull request Apr 3, 2026

build(deps): bump the pip group across 2 directories with 4 updates #11622

Closed

github-actions bot added the docs-required label Apr 3, 2026

chatgpt-codex-connector bot reviewed Apr 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the pip group across 3 directories with 10 updates#11664

build(deps): bump the pip group across 3 directories with 10 updates#11664
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/pip/lib/wasm-micro-runtime-WAMR-2.4.1/build-scripts/pip-17c4dd0064

dependabot bot commented on behalf of github Apr 3, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Apr 3, 2026

Uh oh!

chatgpt-codex-connector bot Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

		@@ -1,10 +1,10 @@
		Flask==1.1.4
		Flask==3.1.3

Conversation

dependabot bot commented on behalf of github Apr 3, 2026

v2.33.0

2.33.0 (2026-03-25)

New Contributors

v2.32.5

2.32.5 (2025-08-18)

2.33.0 (2026-03-25)

2.32.5 (2025-08-18)

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

6.0.0

Breaking

What's Changed

5.0.1

What's Changed

New Contributors

5.0.0

What's Changed

4.0.2

What's Changed

New Contributors

Change Log

4.0.1

Security

4.0.0

3.1.01

3.1.6

3.1.5

3.1.4

3.1.3

3.1.2

Version 3.1.6

Version 3.1.5

Version 3.1.4

Version 3.1.3

v2.33.0

2.33.0 (2026-03-25)

New Contributors

v2.32.5

2.32.5 (2025-08-18)

2.33.0 (2026-03-25)

2.32.5 (2025-08-18)

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

3.1.6

3.1.5

3.1.4

3.1.3

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development