mCaptcha/examples

Fork 0

chore(deps): update dependency werkzeug to v3.1.4 #5

Open

renovate-bot wants to merge 1 commit from renovate/werkzeug-3.x into master

renovate-bot commented

2024-06-04 13:31:36 +05:30

Member

This PR contains the following updates:

Package	Change	Age	Confidence
Werkzeug (changelog)	`==3.0.1` -> `==3.1.4`

Release Notes

pallets/werkzeug (Werkzeug)

`v3.1.4`

Compare Source

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents
reading from these when using send_from_directory. secure_filename
already prevented writing to these. :ghsa:hgf8-39gv-g3f2
The debugger pin fails after 10 attempts instead of 11. :pr:3020
The multipart form parser handles a \r\n sequence at a chunk boundary.
:issue:3065
Improve CPU usage during Watchdog reloader. :issue:3054
Request.json annotation is more accurate. :issue:3067
Traceback rendering handles when the line number is beyond the available
source lines. :issue:3044
HTTPException.get_response annotation and doc better conveys the
distinction between WSGI and sans-IO responses. :issue:3056

`v3.1.3`

Compare Source

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts
list, tuple, or set when passing multiple values. It had been
changed to accept any Collection, but this matched types that should be
treated as single values, such as bytes. :issue:2994
When the Host header is not set and Request.host falls back to the
WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped
in [] to match the Host header. :issue:2993

`v3.1.2`

Compare Source

Released 2024-11-04

Improve type annotation for TypeConversionDict.get to allow the type
parameter to be a callable. :issue:2988
Headers does not inherit from MutableMapping, as it is does not
exactly match that interface. :issue:2989

`v3.1.1`

Compare Source

Released 2024-11-01

Fix an issue that caused str(Request.headers) to always appear empty.
:issue:2985

`v3.1.0`

Compare Source

Released 2024-10-31

Drop support for Python 3.8. :pr:2966
Remove previously deprecated code. :pr:2967
Request.max_form_memory_size defaults to 500kB instead of unlimited.
Non-file form fields over this size will cause a RequestEntityTooLarge
error. :issue:2964
OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
Use MultiDict and ImmutableMultiDict instead. :issue:2968
Behavior of properties on request.cache_control and
response.cache_control has been significantly adjusted.
- Dict values are always str | None. Setting properties will convert
  the value to a string. Setting a property to False is equivalent to
  setting it to None. Getting typed properties will return None if
  conversion raises ValueError, rather than the string. :issue:2980
- max_age is None if present without a value, rather than -1.
  :issue:2980
- no_cache is a boolean for requests, it is True instead of
  "*" when present. It remains a string for responses. :issue:2980
- max_stale is True if present without a value, rather
  than "*". :issue:2980
- no_transform is a boolean. Previously it was mistakenly always
  None. :issue:2881
- min_fresh is None if present without a value, rather than
  "*". :issue:2881
- private is True if present without a value, rather than "*".
  :issue:2980
- Added the must_understand property. :issue:2881
- Added the stale_while_revalidate, and stale_if_error
  properties. :issue:2948
- Type annotations more accurately reflect the values. :issue:2881
Support Cookie CHIPS (Partitioned Cookies). :issue:2797
Add 421 MisdirectedRequest HTTP exception. :issue:2850
Increase default work factor for PBKDF2 to 1,000,000 iterations.
:issue:2969
Inline annotations for datastructures, removing stub files.
:issue:2970
MultiDict.getlist catches TypeError in addition to ValueError
when doing type conversion. :issue:2976
Implement | and |= operators for MultiDict, Headers, and
CallbackDict, and disallow |= on immutable types. :issue:2977

`v3.0.6`

Compare Source

Released 2024-10-25

Fix how max_form_memory_size is applied when parsing large non-file
fields. :ghsa:q34m-jh98-gwm2
safe_join catches certain paths on Windows that were not caught by
ntpath.isabs on Python < 3.11. :ghsa:f9vj-2wh5-fj8j

`v3.0.5`

Compare Source

Released 2024-10-24

The Watchdog reloader ignores file closed no write events. :issue:2945
Logging works with client addresses containing an IPv6 scope :issue:2952
Ignore invalid authorization parameters. :issue:2955
Improve type annotation fore SharedDataMiddleware. :issue:2958
Compatibility with Python 3.13 when generating debugger pin and the current
UID does not have an associated name. :issue:2957

`v3.0.4`

Compare Source

Released 2024-08-21

Restore behavior where parsing multipart/x-www-form-urlencoded data with
invalid UTF-8 bytes in the body results in no form data parsed rather than a
413 error. :issue:2930
Improve parse_options_header performance when parsing unterminated
quoted string values. :issue:2904
Debugger pin auth is synchronized across threads/processes when tracking
failed entries. :issue:2916
Dev server handles unexpected SSLEOFError due to issue in Python < 3.13.
:issue:2926
Debugger pin auth works when the URL already contains a query string.
:issue:2918

`v3.0.3`

Compare Source

Released 2024-05-05

Only allow localhost, .localhost, 127.0.0.1, or the specified
hostname when running the dev server, to make debugger requests. Additional
hosts can be added by using the debugger middleware directly. The debugger
UI makes requests using the full URL rather than only the path.
:ghsa:2g68-c3qc-8985
Make reloader more robust when "" is in sys.path. :pr:2823
Better TLS cert format with adhoc dev certs. :pr:2891
Inform Python < 3.12 how to handle itms-services URIs correctly, rather
than using an overly-broad workaround in Werkzeug that caused some redirect
URIs to be passed on without encoding. :issue:2828
Type annotation for Rule.endpoint and other uses of endpoint is
Any. :issue:2836
Make reloader more robust when "" is in sys.path. :pr:2823

`v3.0.2`

Compare Source

Released 2024-04-01

Ensure setting merge_slashes to False results in NotFound for
repeated-slash requests against single slash routes. :issue:2834
Fix handling of TypeError in TypeConversionDict.get() to match
ValueError. :issue:2843
Fix response_wrapper type check in test client. :issue:2831
Make the return type of MultiPartParser.parse more precise.
:issue:2840
Raise an error if converter arguments cannot be parsed. :issue:2822

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [Werkzeug](https://github.com/pallets/werkzeug) ([changelog](https://werkzeug.palletsprojects.com/page/changes/)) | `==3.0.1` -> `==3.1.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/werkzeug/3.1.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/werkzeug/3.0.1/3.1.4?slim=true) | --- ### Release Notes <details> <summary>pallets/werkzeug (Werkzeug)</summary> ### [`v3.1.4`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-314) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.3...3.1.4) Released 2025-11-28 - `safe_join` on Windows does not allow special device names. This prevents reading from these when using `send_from_directory`. `secure_filename` already prevented writing to these. :ghsa:`hgf8-39gv-g3f2` - The debugger pin fails after 10 attempts instead of 11. :pr:`3020` - The multipart form parser handles a `\r\n` sequence at a chunk boundary. :issue:`3065` - Improve CPU usage during Watchdog reloader. :issue:`3054` - `Request.json` annotation is more accurate. :issue:`3067` - Traceback rendering handles when the line number is beyond the available source lines. :issue:`3044` - `HTTPException.get_response` annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:`3056` ### [`v3.1.3`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-313) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.2...3.1.3) Released 2024-11-08 - Initial data passed to `MultiDict` and similar interfaces only accepts `list`, `tuple`, or `set` when passing multiple values. It had been changed to accept any `Collection`, but this matched types that should be treated as single values, such as `bytes`. :issue:`2994` - When the `Host` header is not set and `Request.host` falls back to the WSGI `SERVER_NAME` value, if that value is an IPv6 address it is wrapped in `[]` to match the `Host` header. :issue:`2993` ### [`v3.1.2`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-312) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.1...3.1.2) Released 2024-11-04 - Improve type annotation for `TypeConversionDict.get` to allow the `type` parameter to be a callable. :issue:`2988` - `Headers` does not inherit from `MutableMapping`, as it is does not exactly match that interface. :issue:`2989` ### [`v3.1.1`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-311) [Compare Source](https://github.com/pallets/werkzeug/compare/3.1.0...3.1.1) Released 2024-11-01 - Fix an issue that caused `str(Request.headers)` to always appear empty. :issue:`2985` ### [`v3.1.0`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-310) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.6...3.1.0) Released 2024-10-31 - Drop support for Python 3.8. :pr:`2966` - Remove previously deprecated code. :pr:`2967` - `Request.max_form_memory_size` defaults to 500kB instead of unlimited. Non-file form fields over this size will cause a `RequestEntityTooLarge` error. :issue:`2964` - `OrderedMultiDict` and `ImmutableOrderedMultiDict` are deprecated. Use `MultiDict` and `ImmutableMultiDict` instead. :issue:`2968` - Behavior of properties on `request.cache_control` and `response.cache_control` has been significantly adjusted. - Dict values are always `str | None`. Setting properties will convert the value to a string. Setting a property to `False` is equivalent to setting it to `None`. Getting typed properties will return `None` if conversion raises `ValueError`, rather than the string. :issue:`2980` - `max_age` is `None` if present without a value, rather than `-1`. :issue:`2980` - `no_cache` is a boolean for requests, it is `True` instead of `"*"` when present. It remains a string for responses. :issue:`2980` - `max_stale` is `True` if present without a value, rather than `"*"`. :issue:`2980` - `no_transform` is a boolean. Previously it was mistakenly always `None`. :issue:`2881` - `min_fresh` is `None` if present without a value, rather than `"*"`. :issue:`2881` - `private` is `True` if present without a value, rather than `"*"`. :issue:`2980` - Added the `must_understand` property. :issue:`2881` - Added the `stale_while_revalidate`, and `stale_if_error` properties. :issue:`2948` - Type annotations more accurately reflect the values. :issue:`2881` - Support Cookie CHIPS (Partitioned Cookies). :issue:`2797` - Add 421 `MisdirectedRequest` HTTP exception. :issue:`2850` - Increase default work factor for PBKDF2 to 1,000,000 iterations. :issue:`2969` - Inline annotations for `datastructures`, removing stub files. :issue:`2970` - `MultiDict.getlist` catches `TypeError` in addition to `ValueError` when doing type conversion. :issue:`2976` - Implement `|` and `|=` operators for `MultiDict`, `Headers`, and `CallbackDict`, and disallow `|=` on immutable types. :issue:`2977` ### [`v3.0.6`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-306) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.5...3.0.6) Released 2024-10-25 - Fix how `max_form_memory_size` is applied when parsing large non-file fields. :ghsa:`q34m-jh98-gwm2` - `safe_join` catches certain paths on Windows that were not caught by `ntpath.isabs` on Python < 3.11. :ghsa:`f9vj-2wh5-fj8j` ### [`v3.0.5`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-305) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.4...3.0.5) Released 2024-10-24 - The Watchdog reloader ignores file closed no write events. :issue:`2945` - Logging works with client addresses containing an IPv6 scope :issue:`2952` - Ignore invalid authorization parameters. :issue:`2955` - Improve type annotation fore `SharedDataMiddleware`. :issue:`2958` - Compatibility with Python 3.13 when generating debugger pin and the current UID does not have an associated name. :issue:`2957` ### [`v3.0.4`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-304) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.3...3.0.4) Released 2024-08-21 - Restore behavior where parsing `multipart/x-www-form-urlencoded` data with invalid UTF-8 bytes in the body results in no form data parsed rather than a 413 error. :issue:`2930` - Improve `parse_options_header` performance when parsing unterminated quoted string values. :issue:`2904` - Debugger pin auth is synchronized across threads/processes when tracking failed entries. :issue:`2916` - Dev server handles unexpected `SSLEOFError` due to issue in Python < 3.13. :issue:`2926` - Debugger pin auth works when the URL already contains a query string. :issue:`2918` ### [`v3.0.3`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-303) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.2...3.0.3) Released 2024-05-05 - Only allow `localhost`, `.localhost`, `127.0.0.1`, or the specified hostname when running the dev server, to make debugger requests. Additional hosts can be added by using the debugger middleware directly. The debugger UI makes requests using the full URL rather than only the path. :ghsa:`2g68-c3qc-8985` - Make reloader more robust when `""` is in `sys.path`. :pr:`2823` - Better TLS cert format with `adhoc` dev certs. :pr:`2891` - Inform Python < 3.12 how to handle `itms-services` URIs correctly, rather than using an overly-broad workaround in Werkzeug that caused some redirect URIs to be passed on without encoding. :issue:`2828` - Type annotation for `Rule.endpoint` and other uses of `endpoint` is `Any`. :issue:`2836` - Make reloader more robust when `""` is in `sys.path`. :pr:`2823` ### [`v3.0.2`](https://github.com/pallets/werkzeug/blob/HEAD/CHANGES.rst#Version-302) [Compare Source](https://github.com/pallets/werkzeug/compare/3.0.1...3.0.2) Released 2024-04-01 - Ensure setting `merge_slashes` to `False` results in `NotFound` for repeated-slash requests against single slash routes. :issue:`2834` - Fix handling of `TypeError` in `TypeConversionDict.get()` to match `ValueError`. :issue:`2843` - Fix `response_wrapper` type check in test client. :issue:`2831` - Make the return type of `MultiPartParser.parse` more precise. :issue:`2840` - Raise an error if converter arguments cannot be parsed. :issue:`2822` </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate-bot

label

2024-06-04 13:31:36 +05:30

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.0.3~~ to chore(deps): update dependency werkzeug to v3.0.4

2024-08-22 01:31:35 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from 9bc02829d4 to f5ca577b81

2024-08-22 01:31:37 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.0.4~~ to chore(deps): update dependency werkzeug to v3.0.5

2024-10-25 06:31:39 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from f5ca577b81 to 7a2317a5bf

2024-10-25 06:31:41 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.0.5~~ to chore(deps): update dependency werkzeug to v3.0.6

2024-10-26 00:31:34 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from 7a2317a5bf to e9c047864f

2024-10-26 00:31:36 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.0.6~~ to chore(deps): update dependency werkzeug to v3.1.0

2024-10-31 23:02:33 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from e9c047864f to 6fdafd3758

2024-10-31 23:02:35 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.1.0~~ to chore(deps): update dependency werkzeug to v3.1.1

2024-11-02 13:03:57 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from 6fdafd3758 to fb063be3a9

2024-11-02 13:03:58 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.1.1~~ to chore(deps): update dependency werkzeug to v3.1.3

2024-12-23 18:07:29 +05:30

renovate-bot force-pushed renovate/werkzeug-3.x from fb063be3a9 to 72426e7115

2024-12-23 18:07:30 +05:30

Compare

renovate-bot force-pushed renovate/werkzeug-3.x from 72426e7115 to dff94d2700

2025-12-01 05:12:07 +05:30

Compare

renovate-bot changed title from ~~chore(deps): update dependency werkzeug to v3.1.3~~ to chore(deps): update dependency werkzeug to v3.1.4

2025-12-01 05:12:08 +05:30

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/werkzeug-3.x:renovate/werkzeug-3.x

git switch renovate/werkzeug-3.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master

git merge --no-ff renovate/werkzeug-3.x

git switch renovate/werkzeug-3.x

git rebase master

git switch master

git merge --ff-only renovate/werkzeug-3.x

git switch renovate/werkzeug-3.x

git rebase master

git switch master

git merge --no-ff renovate/werkzeug-3.x

git switch master

git merge --squash renovate/werkzeug-3.x