Flask

Latest version: v3.0.3

Safety actively analyzes 619599 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 10

1.1.3

Not secure
-------------

Released 2021-05-13

- Set maximum versions of Werkzeug, Jinja, Click, and ItsDangerous.
:issue:`4043`
- Re-add support for passing a ``pathlib.Path`` for ``static_folder``.
:pr:`3579`

1.1.2

Not secure
-------------

Released 2020-04-03

- Work around an issue when running the ``flask`` command with an
external debugger on Windows. :issue:`3297`
- The static route will not catch all URLs if the ``Flask``
``static_folder`` argument ends with a slash. :issue:`3452`

1.1.1

Not secure
-------------

Released 2019-07-08

- The ``flask.json_available`` flag was added back for compatibility
with some extensions. It will raise a deprecation warning when used,
and will be removed in version 2.0.0. :issue:`3288`

1.1.0

Not secure
-------------

Released 2019-07-04

- Bump minimum Werkzeug version to >= 0.15.
- Drop support for Python 3.4.
- Error handlers for ``InternalServerError`` or ``500`` will always be
passed an instance of ``InternalServerError``. If they are invoked
due to an unhandled exception, that original exception is now
available as ``e.original_exception`` rather than being passed
directly to the handler. The same is true if the handler is for the
base ``HTTPException``. This makes error handler behavior more
consistent. :pr:`3266`

- ``Flask.finalize_request`` is called for all unhandled
exceptions even if there is no ``500`` error handler.

- ``Flask.logger`` takes the same name as ``Flask.name`` (the value
passed as ``Flask(import_name)``. This reverts 1.0's behavior of
always logging to ``"flask.app"``, in order to support multiple apps
in the same process. A warning will be shown if old configuration is
detected that needs to be moved. :issue:`2866`
- ``RequestContext.copy`` includes the current session object in the
request context copy. This prevents ``session`` pointing to an
out-of-date object. :issue:`2935`
- Using built-in RequestContext, unprintable Unicode characters in
Host header will result in a HTTP 400 response and not HTTP 500 as
previously. :pr:`2994`
- ``send_file`` supports ``PathLike`` objects as described in
:pep:`519`, to support ``pathlib`` in Python 3. :pr:`3059`
- ``send_file`` supports ``BytesIO`` partial content.
:issue:`2957`
- ``open_resource`` accepts the "rt" file mode. This still does the
same thing as "r". :issue:`3163`
- The ``MethodView.methods`` attribute set in a base class is used by
subclasses. :issue:`3138`
- ``Flask.jinja_options`` is a ``dict`` instead of an
``ImmutableDict`` to allow easier configuration. Changes must still
be made before creating the environment. :pr:`3190`
- Flask's ``JSONMixin`` for the request and response wrappers was
moved into Werkzeug. Use Werkzeug's version with Flask-specific
support. This bumps the Werkzeug dependency to >= 0.15.
:issue:`3125`
- The ``flask`` command entry point is simplified to take advantage
of Werkzeug 0.15's better reloader support. This bumps the Werkzeug
dependency to >= 0.15. :issue:`3022`
- Support ``static_url_path`` that ends with a forward slash.
:issue:`3134`
- Support empty ``static_folder`` without requiring setting an empty
``static_url_path`` as well. :pr:`3124`
- ``jsonify`` supports ``dataclass`` objects. :pr:`3195`
- Allow customizing the ``Flask.url_map_class`` used for routing.
:pr:`3069`
- The development server port can be set to 0, which tells the OS to
pick an available port. :issue:`2926`
- The return value from ``cli.load_dotenv`` is more consistent with
the documentation. It will return ``False`` if python-dotenv is not
installed, or if the given path isn't a file. :issue:`2937`
- Signaling support has a stub for the ``connect_via`` method when
the Blinker library is not installed. :pr:`3208`
- Add an ``--extra-files`` option to the ``flask run`` CLI command to
specify extra files that will trigger the reloader on change.
:issue:`2897`
- Allow returning a dictionary from a view function. Similar to how
returning a string will produce a ``text/html`` response, returning
a dict will call ``jsonify`` to produce a ``application/json``
response. :pr:`3111`
- Blueprints have a ``cli`` Click group like ``app.cli``. CLI commands
registered with a blueprint will be available as a group under the
``flask`` command. :issue:`1357`.
- When using the test client as a context manager (``with client:``),
all preserved request contexts are popped when the block exits,
ensuring nested contexts are cleaned up correctly. :pr:`3157`
- Show a better error message when the view return type is not
supported. :issue:`3214`
- ``flask.testing.make_test_environ_builder()`` has been deprecated in
favour of a new class ``flask.testing.EnvironBuilder``. :pr:`3232`
- The ``flask run`` command no longer fails if Python is not built
with SSL support. Using the ``--cert`` option will show an
appropriate error message. :issue:`3211`
- URL matching now occurs after the request context is pushed, rather
than when it's created. This allows custom URL converters to access
the app and request contexts, such as to query a database for an id.
:issue:`3088`

1.0.4

Not secure
-------------

Released 2019-07-04

- The key information for ``BadRequestKeyError`` is no longer cleared
outside debug mode, so error handlers can still access it. This
requires upgrading to Werkzeug 0.15.5. :issue:`3249`
- ``send_file`` url quotes the ":" and "/" characters for more
compatible UTF-8 filename support in some browsers. :issue:`3074`
- Fixes for :pep:`451` import loaders and pytest 5.x. :issue:`3275`
- Show message about dotenv on stderr instead of stdout. :issue:`3285`

1.0.3

Not secure
-------------

Released 2019-05-17

- ``send_file`` encodes filenames as ASCII instead of Latin-1
(ISO-8859-1). This fixes compatibility with Gunicorn, which is
stricter about header encodings than :pep:`3333`. :issue:`2766`
- Allow custom CLIs using ``FlaskGroup`` to set the debug flag without
it always being overwritten based on environment variables.
:pr:`2765`
- ``flask --version`` outputs Werkzeug's version and simplifies the
Python version. :pr:`2825`
- ``send_file`` handles an ``attachment_filename`` that is a native
Python 2 string (bytes) with UTF-8 coded bytes. :issue:`2933`
- A catch-all error handler registered for ``HTTPException`` will not
handle ``RoutingException``, which is used internally during
routing. This fixes the unexpected behavior that had been introduced
in 1.0. :pr:`2986`
- Passing the ``json`` argument to ``app.test_client`` does not
push/pop an extra app context. :issue:`2900`

Page 5 of 10

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.