Created by: dependabot[bot]
Bumps flask from 0.12.3 to 1.0.
Sourced from flask's releases.
The Pallets team is pleased to release Flask 1.0. [Read the announcement on our blog.](https://www.palletsprojects.com/blog/flask-1-0-released/
There are over a year's worth of changes in this release. Many features have been improved or changed. Read the changelog to understand how your project's code will be affected.
JSON Security Fix
Flask previously decoded incoming JSON bytes using the content type of the request. Although JSON should only be encoded as UTF-8, Flask was more lenient. However, Python includes non-text related encodings that could result in unexpected memory use by a request.
Flask will now detect the encoding of incoming JSON data as one of the supported UTF encodings, and will not allow arbitrary encodings from the request.
Install or Upgrade
Install from PyPI with pip:
pip install -U Flask
This is a repackage of 0.12.3 to fix an issue with how the package was built.
Upgrade from PyPI with pip. Use a version identifier if you want to stay at 0.12:
pip install -U 'Flask~=0.12.4'
Sourced from flask's changelog.
- Python 2.6 and 3.3 are no longer supported.
- Bump minimum dependency versions to the latest stable versions: Werkzeug >= 0.14, Jinja >= 2.10, itsdangerous >= 0.24, Click >= 5.1. :issue:
- Skip :meth:
app.run <Flask.run>when a Flask application is run from the command line. This avoids some behavior that was confusing to debug.
- Change the default for :data:
~json.jsonifyreturns a compact format by default, and an indented format in debug mode.
Flask.__init__ <Flask>accepts the
host_matchingargument and sets it on :attr:
Flask.__init__ <Flask>accepts the
static_hostargument and passes it as the
hostargument when defining the static route. :issue:
send_filesupports Unicode in
_schemeargument from :func:
provide_automatic_optionsargument to disable adding the
~views.MethodViewsubclasses inherit method handlers from base classes.
- Errors caused while opening the session at the beginning of the request are handled by the app's error handlers.
- Blueprints gained :attr:
~Blueprint.json_decoderattributes to override the app's encoder and decoder.
ValueErrorfor bad response types. The error messages have been improved to describe why the type is invalid.
routesCLI command to output routes registered on the application.
- Show warning when session cookie domain is a bare hostname or an IP address, as these may not behave properly in some browsers, such as Chrome.
- Allow IP address as exact session cookie domain.
SESSION_COOKIE_DOMAINis set if it is detected through
- Auto-detect zero-argument app factory called
- Factory functions are not required to take a
script_infoparameter to work with the
flaskcommand. If they take a single parameter or a parameter named
291f3c3Bump version number to 1.0
216151cMerge branch '0.12-maintenance'
23047a7Bump version number to 0.12.4.dev
062745bMerge pull request #2720 from pallets/setup-link
5c8110densure order of project urls
10a77a5Add project_urls so that PyPI will show GitHub stats.
2ede0b8add donate link
4137aecadd donate link
4df5f82Merge pull request #2719 from greyli/patch-9
- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR
@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it
@dependabot mergewill merge this PR after your CI passes on it
@dependabot squash and mergewill squash and merge this PR after your CI passes on it
@dependabot cancel mergewill cancel a previously requested merge and block automerging
@dependabot reopenwill reopen this PR if it is closed
@dependabot ignore this [patch|minor|major] versionwill close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labelswill set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewerswill set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assigneeswill set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestonewill set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the Security Alerts page.