fix(deps): update dependency werkzeug to v3 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
Werkzeug (changelog)	==2.1.1 -> ==3.1.4

GitHub Vulnerability Alerts

CVE-2023-23934

Browsers may allow "nameless" cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain.

Werkzeug <= 2.2.2 will parse the cookie =__Host-test=bad as __Host-test=bad. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.

CVE-2023-25577

Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses request.data, request.form, request.files, or request.get_data(parse_form_data=False), it can cause unexpectedly high resource usage.

This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.

CVE-2023-46136

Werkzeug multipart data parser needs to find a boundary that may be between consecutive chunks. That's why parsing is based on looking for newline characters. Unfortunately, code looking for partial boundary in the buffer is written inefficiently, so if we upload a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer.

This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.

CVE-2024-34069

The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.

CVE-2024-49766

On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable.

CVE-2024-49767

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.max_form_memory_size setting.

The Request.max_content_length setting, as well as resource limits provided by deployment software and platforms, are also available to limit the resources used during a request. This vulnerability does not affect those settings. All three types of limits should be considered and set appropriately when deploying an application.

CVE-2025-66221

Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

---

Release Notes

pallets/werkzeug (Werkzeug)

v3.1.4

Compare Source

Released 2025-11-28

• safe_join on Windows does not allow special device names. This prevents
  reading from these when using send_from_directory. secure_filename
  already prevented writing to these. :ghsa:hgf8-39gv-g3f2
• The debugger pin fails after 10 attempts instead of 11. :pr:3020
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  :issue:3065
• Improve CPU usage during Watchdog reloader. :issue:3054
• Request.json annotation is more accurate. :issue:3067
• Traceback rendering handles when the line number is beyond the available
  source lines. :issue:3044
• HTTPException.get_response annotation and doc better conveys the
  distinction between WSGI and sans-IO responses. :issue:3056

v3.1.3

Compare Source

Released 2024-11-08

• Initial data passed to MultiDict and similar interfaces only accepts
  list, tuple, or set when passing multiple values. It had been
  changed to accept any Collection, but this matched types that should be
  treated as single values, such as bytes. :issue:2994
• When the Host header is not set and Request.host falls back to the
  WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped
  in [] to match the Host header. :issue:2993

v3.1.2

Compare Source

Released 2024-11-04

• Improve type annotation for TypeConversionDict.get to allow the type
  parameter to be a callable. :issue:2988
• Headers does not inherit from MutableMapping, as it is does not
  exactly match that interface. :issue:2989

v3.1.1

Compare Source

Released 2024-11-01

• Fix an issue that caused str(Request.headers) to always appear empty.
  :issue:2985

v3.1.0

Compare Source

Released 2024-10-31

• Drop support for Python 3.8. :pr:2966

• Remove previously deprecated code. :pr:2967

• Request.max_form_memory_size defaults to 500kB instead of unlimited.
  Non-file form fields over this size will cause a RequestEntityTooLarge
  error. :issue:2964

• OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
  Use MultiDict and ImmutableMultiDict instead. :issue:2968

• Behavior of properties on request.cache_control and
  response.cache_control has been significantly adjusted.

  • Dict values are always str | None. Setting properties will convert
    the value to a string. Setting a property to False is equivalent to
    setting it to None. Getting typed properties will return None if
    conversion raises ValueError, rather than the string. :issue:2980
  • max_age is None if present without a value, rather than -1.
    :issue:2980
  • no_cache is a boolean for requests, it is True instead of
    "*" when present. It remains a string for responses. :issue:2980
  • max_stale is True if present without a value, rather
    than "*". :issue:2980
  • no_transform is a boolean. Previously it was mistakenly always
    None. :issue:2881
  • min_fresh is None if present without a value, rather than
    "*". :issue:2881
  • private is True if present without a value, rather than "*".
    :issue:2980
  • Added the must_understand property. :issue:2881
  • Added the stale_while_revalidate, and stale_if_error
    properties. :issue:2948
  • Type annotations more accurately reflect the values. :issue:2881

• Support Cookie CHIPS (Partitioned Cookies). :issue:2797

• Add 421 MisdirectedRequest HTTP exception. :issue:2850

• Increase default work factor for PBKDF2 to 1,000,000 iterations.
  :issue:2969

• Inline annotations for datastructures, removing stub files.
  :issue:2970

• MultiDict.getlist catches TypeError in addition to ValueError
  when doing type conversion. :issue:2976

• Implement | and |= operators for MultiDict, Headers, and
  CallbackDict, and disallow |= on immutable types. :issue:2977

v3.0.6

Compare Source

Released 2024-10-25

• Fix how max_form_memory_size is applied when parsing large non-file
  fields. :ghsa:q34m-jh98-gwm2
• safe_join catches certain paths on Windows that were not caught by
  ntpath.isabs on Python < 3.11. :ghsa:f9vj-2wh5-fj8j

v3.0.5

Compare Source

Released 2024-10-24

• The Watchdog reloader ignores file closed no write events. :issue:2945
• Logging works with client addresses containing an IPv6 scope :issue:2952
• Ignore invalid authorization parameters. :issue:2955
• Improve type annotation fore SharedDataMiddleware. :issue:2958
• Compatibility with Python 3.13 when generating debugger pin and the current
  UID does not have an associated name. :issue:2957

v3.0.4

Compare Source

Released 2024-08-21

• Restore behavior where parsing multipart/x-www-form-urlencoded data with
  invalid UTF-8 bytes in the body results in no form data parsed rather than a
  413 error. :issue:2930
• Improve parse_options_header performance when parsing unterminated
  quoted string values. :issue:2904
• Debugger pin auth is synchronized across threads/processes when tracking
  failed entries. :issue:2916
• Dev server handles unexpected SSLEOFError due to issue in Python < 3.13.
  :issue:2926
• Debugger pin auth works when the URL already contains a query string.
  :issue:2918

v3.0.3

Compare Source

Released 2024-05-05

• Only allow localhost, .localhost, 127.0.0.1, or the specified
  hostname when running the dev server, to make debugger requests. Additional
  hosts can be added by using the debugger middleware directly. The debugger
  UI makes requests using the full URL rather than only the path.
  :ghsa:2g68-c3qc-8985
• Make reloader more robust when "" is in sys.path. :pr:2823
• Better TLS cert format with adhoc dev certs. :pr:2891
• Inform Python < 3.12 how to handle itms-services URIs correctly, rather
  than using an overly-broad workaround in Werkzeug that caused some redirect
  URIs to be passed on without encoding. :issue:2828
• Type annotation for Rule.endpoint and other uses of endpoint is
  Any. :issue:2836
• Make reloader more robust when "" is in sys.path. :pr:2823

v3.0.2

Compare Source

Released 2024-04-01

• Ensure setting merge_slashes to False results in NotFound for
  repeated-slash requests against single slash routes. :issue:2834
• Fix handling of TypeError in TypeConversionDict.get() to match
  ValueError. :issue:2843
• Fix response_wrapper type check in test client. :issue:2831
• Make the return type of MultiPartParser.parse more precise.
  :issue:2840
• Raise an error if converter arguments cannot be parsed. :issue:2822

v3.0.1

Compare Source

Released 2023-10-24

• Fix slow multipart parsing for large parts potentially enabling DoS attacks.

v3.0.0

Compare Source

Released 2023-09-30

• Remove previously deprecated code. :pr:2768
• Deprecate the __version__ attribute. Use feature detection, or
  importlib.metadata.version("werkzeug"), instead. :issue:2770
• generate_password_hash uses scrypt by default. :issue:2769
• Add the "werkzeug.profiler" item to the WSGI environ dictionary
  passed to ProfilerMiddleware's filename_format function. It contains
  the elapsed and time values for the profiled request. :issue:2775
• Explicitly marked the PathConverter as non path isolating. :pr:2784

v2.3.8

Compare Source

Released 2023-11-08

• Fix slow multipart parsing for large parts potentially enabling DoS
  attacks.

v2.3.7

Compare Source

Released 2023-08-14

• Use flit_core instead of setuptools as build backend.
• Fix parsing of multipart bodies. :issue:2734
• Adjust index of last newline in data start. :issue:2761
• Parsing ints from header values strips spacing first. :issue:2734
• Fix empty file streaming when testing. :issue:2740
• Clearer error message when URL rule does not start with slash. :pr:2750
• Accept q value can be a float without a decimal part. :issue:2751

v2.3.6

Compare Source

Released 2023-06-08

• FileStorage.content_length does not fail if the form data did not provide a
  value. :issue:2726

v2.3.5

Compare Source

Released 2023-06-07

• Python 3.12 compatibility. :issue:2704
• Fix handling of invalid base64 values in Authorization.from_header. :issue:2717
• The debugger escapes the exception message in the page title. :pr:2719
• When binding routing.Map, a long IDNA server_name with a port does not fail
  encoding. :issue:2700
• iri_to_uri shows a deprecation warning instead of an error when passing bytes.
  :issue:2708
• When parsing numbers in HTTP request headers such as Content-Length, only ASCII
  digits are accepted rather than any format that Python's int and float
  accept. :issue:2716

v2.3.4

Compare Source

Released 2023-05-08

• Authorization.from_header and WWWAuthenticate.from_header detects tokens
  that end with base64 padding (=). :issue:2685
• Remove usage of warnings.catch_warnings. :issue:2690
• Remove max_form_parts restriction from standard form data parsing and only use
  if for multipart content. :pr:2694
• Response will avoid converting the Location header in some cases to preserve
  invalid URL schemes like itms-services. :issue:2691

v2.3.3

Compare Source

Released 2023-05-01

• Fix parsing of large multipart bodies. Remove invalid leading newline, and restore
  parsing speed. :issue:2658, 2675
• The cookie Path attribute is set to / by default again, to prevent clients
  from falling back to RFC 6265's default-path behavior. :issue:2672, 2679

v2.3.2

Compare Source

Released 2023-04-28

• Parse the cookie Expires attribute correctly in the test client. :issue:2669
• max_content_length can only be enforced on streaming requests if the server
  sets wsgi.input_terminated. :issue:2668

v2.3.1

Compare Source

Released 2023-04-27

• Percent-encode plus (+) when building URLs and in test requests. :issue:2657
• Cookie values don't quote characters defined in RFC 6265. :issue:2659
• Include pyi files for datastructures type annotations. :issue:2660
• Authorization and WWWAuthenticate objects can be compared for equality.
  :issue:2665

v2.3.0

Compare Source

Released 2023-04-25

• Drop support for Python 3.7. :pr:2648

• Remove previously deprecated code. :pr:2592

• Passing bytes where strings are expected is deprecated, as well as the charset
  and errors parameters in many places. Anywhere that was annotated, documented,
  or tested to accept bytes shows a warning. Removing this artifact of the transition
  from Python 2 to 3 removes a significant amount of overhead in instance checks and
  encoding cycles. In general, always work with UTF-8, the modern HTML, URL, and HTTP
  standards all strongly recommend this. :issue:2602

• Deprecate the werkzeug.urls module, except for the uri_to_iri and
  iri_to_uri functions. Use the urllib.parse library instead. :issue:2600

• Update which characters are considered safe when using percent encoding in URLs,
  based on the WhatWG URL Standard. :issue:2601

• Update which characters are considered safe when using percent encoding for Unicode
  filenames in downloads. :issue:2598

• Deprecate the safe_conversion parameter of iri_to_uri. The Location
  header is converted to IRI using the same process as everywhere else. :issue:2609

• Deprecate werkzeug.wsgi.make_line_iter and make_chunk_iter. :pr:2613

• Use modern packaging metadata with pyproject.toml instead of setup.cfg.
  :pr:2574

• Request.get_json() will raise a 415 Unsupported Media Type error if the
  Content-Type header is not application/json, instead of a generic 400.
  :issue:2550

• A URL converter's part_isolating defaults to False if its regex contains
  a /. :issue:2582

• A custom converter's regex can have capturing groups without breaking the router.
  :pr:2596

• The reloader can pick up arguments to python like -X dev, and does not
  require heuristics to determine how to reload the command. Only available
  on Python >= 3.10. :issue:2589

• The Watchdog reloader ignores file opened events. Bump the minimum version of
  Watchdog to 2.3.0. :issue:2603

• When using a Unix socket for the development server, the path can start with a dot.
  :issue:2595

• Increase default work factor for PBKDF2 to 600,000 iterations. :issue:2611

• parse_options_header is 2-3 times faster. It conforms to :rfc:9110, some
  invalid parts that were previously accepted are now ignored. :issue:1628

• The is_filename parameter to unquote_header_value is deprecated. :pr:2614

• Deprecate the extra_chars parameter and passing bytes to quote_header_value,
  the allow_token parameter to dump_header, and the cls parameter and
  passing bytes to parse_dict_header. :pr:2618

• Improve parse_accept_header implementation. Parse according to :rfc:9110.
  Discard items with invalid q values. :issue:1623

• quote_header_value quotes the empty string. :pr:2618

• dump_options_header skips None values rather than using a bare key.
  :pr:2618

• dump_header and dump_options_header will not quote a value if the key ends
  with an asterisk *.

• parse_dict_header will decode values with charsets. :pr:2618

• Refactor the Authorization and WWWAuthenticate header data structures.
  :issue:1769, :pr:2619

  • Both classes have type, parameters, and token attributes. The
    token attribute supports auth schemes that use a single opaque token rather
    than key=value parameters, such as Bearer.
  • Neither class is a dict anymore, although they still implement getting,
    setting, and deleting auth[key] and auth.key syntax, as well as
    auth.get(key) and key in auth.
  • Both classes have a from_header class method. parse_authorization_header
    and parse_www_authenticate_header are deprecated.
  • The methods WWWAuthenticate.set_basic and set_digest are deprecated.
    Instead, an instance should be created and assigned to
    response.www_authenticate.
  • A list of instances can be assigned to response.www_authenticate to set
    multiple header values. However, accessing the property only returns the first
    instance.

• Refactor parse_cookie and dump_cookie. :pr:2637

  • parse_cookie is up to 40% faster, dump_cookie is up to 60% faster.
  • Passing bytes to parse_cookie and dump_cookie is deprecated. The
    dump_cookie charset parameter is deprecated.
  • dump_cookie allows domain values that do not include a dot ., and
    strips off a leading dot.
  • dump_cookie does not set path="/" unnecessarily by default.

• Refactor the test client cookie implementation. :issue:1060, 1680

  • The cookie_jar attribute is deprecated. http.cookiejar is no longer used
    for storage.
  • Domain and path matching is used when sending cookies in requests. The
    domain and path parameters default to localhost and /.
  • Added a get_cookie method to inspect cookies.
  • Cookies have decoded_key and decoded_value attributes to match what the
    app sees rather than the encoded values a client would see.
  • The first positional server_name parameter to set_cookie and
    delete_cookie is deprecated. Use the domain parameter instead.
  • Other parameters to delete_cookie besides domain, path, and
    value are deprecated.

• If request.max_content_length is set, it is checked immediately when accessing
  the stream, and while reading from the stream in general, rather than only during
  form parsing. :issue:1513

• The development server, which must not be used in production, will exhaust the
  request stream up to 10GB or 1000 reads. This allows clients to see a 413 error if
  max_content_length is exceeded, instead of a "connection reset" failure.
  :pr:2620

• The development server discards header keys that contain underscores _, as they
  are ambiguous with dashes - in WSGI. :pr:2622

• secure_filename looks for more Windows reserved file names. :pr:2623

• Update type annotation for best_match to make default parameter clearer.
  :issue:2625

• Multipart parser handles empty fields correctly. :issue:2632

• The Map charset parameter and Request.url_charset property are
  deprecated. Percent encoding in URLs must always represent UTF-8 bytes. Invalid
  bytes are left percent encoded rather than replaced. :issue:2602

• The Request.charset, Request.encoding_errors, Response.charset, and
  Client.charset attributes are deprecated. Request and response data must always
  use UTF-8. :issue:2602

• Header values that have charset information only allow ASCII, UTF-8, and ISO-8859-1.
  :pr:2614, 2641

• Update type annotation for ProfilerMiddleware stream parameter.
  :issue:2642

• Use postponed evaluation of annotations. :pr:2644

• The development server escapes ASCII control characters in decoded URLs before
  logging the request to the terminal. :pr:2652

• The FormDataParser parse_functions attribute and get_parse_func method,
  and the invalid application/x-url-encoded content type, are deprecated.
  :pr:2653

• generate_password_hash supports scrypt. Plain hash methods are deprecated, only
  scrypt and pbkdf2 are supported. :issue:2654

v2.2.3

Compare Source

Released 2023-02-14

• Ensure that URL rules using path converters will redirect with strict slashes when
  the trailing slash is missing. :issue:2533
• Type signature for get_json specifies that return type is not optional when
  silent=False. :issue:2508
• parse_content_range_header returns None for a value like bytes */-1
  where the length is invalid, instead of raising an AssertionError. :issue:2531
• Address remaining ResourceWarning related to the socket used by run_simple.
  Remove prepare_socket, which now happens when creating the server. :issue:2421
• Update pre-existing headers for multipart/form-data requests with the test
  client. :issue:2549
• Fix handling of header extended parameters such that they are no longer quoted.
  :issue:2529
• LimitedStream.read works correctly when wrapping a stream that may not return
  the requested size in one read call. :issue:2558
• A cookie header that starts with = is treated as an empty key and discarded,
  rather than stripping the leading ==.
• Specify a maximum number of multipart parts, default 1000, after which a
  RequestEntityTooLarge exception is raised on parsing. This mitigates a DoS
  attack where a larger number of form/file parts would result in disproportionate
  resource use.

v2.2.2

Compare Source

Released 2022-08-08

• Fix router to restore the 2.1 strict_slashes == False behaviour
  whereby leaf-requests match branch rules and vice
  versa. :pr:2489
• Fix router to identify invalid rules rather than hang parsing them,
  and to correctly parse / within converter arguments. :pr:2489
• Update subpackage imports in :mod:werkzeug.routing to use the
  import as syntax for explicitly re-exporting public attributes.
  :pr:2493
• Parsing of some invalid header characters is more robust. :pr:2494
• When starting the development server, a warning not to use it in a
  production deployment is always shown. :issue:2480
• LocalProxy.__wrapped__ is always set to the wrapped object when
  the proxy is unbound, fixing an issue in doctest that would cause it
  to fail. :issue:2485
• Address one ResourceWarning related to the socket used by
  run_simple. :issue:2421

v2.2.1

Compare Source

Released 2022-07-27

• Fix router so that /path/ will match a rule /path if strict
  slashes mode is disabled for the rule. :issue:2467
• Fix router so that partial part matches are not allowed
  i.e. /2df does not match /<int>. :pr:2470
• Fix router static part weighting, so that simpler routes are matched
  before more complex ones. :issue:2471
• Restore ValidationError to be importable from
  werkzeug.routing. :issue:2465

v2.2.0

Compare Source

Released 2022-07-23

• Deprecated get_script_name, get_query_string,
  peek_path_info, pop_path_info, and
  extract_path_info. :pr:2461
• Remove previously deprecated code. :pr:2461
• Add MarkupSafe as a dependency and use it to escape values when
  rendering HTML. :issue:2419
• Added the werkzeug.debug.preserve_context mechanism for
  restoring context-local data for a request when running code in the
  debug console. :pr:2439
• Fix compatibility with Python 3.11 by ensuring that end_lineno
  and end_col_offset are present on AST nodes. :issue:2425
• Add a new faster URL matching router based on a state machine. If a custom converter
  needs to match a / it must set the class variable part_isolating = False.
  :pr:2433
• Fix branch leaf path masking branch paths when strict-slashes is
  disabled. :issue:1074
• Names within options headers are always converted to lowercase. This
  matches :rfc:6266 that the case is not relevant. :issue:2442
• AnyConverter validates the value passed for it when building
  URLs. :issue:2388
• The debugger shows enhanced error locations in tracebacks in Python
  3.11. :issue:2407
• Added Sans-IO is_resource_modified and parse_cookie functions
  based on WSGI versions. :issue:2408
• Added Sans-IO get_content_length function. :pr:2415
• Don't assume a mimetype for test responses. :issue:2450
• Type checking FileStorage accepts os.PathLike. :pr:2418

v2.1.2

Compare Source

Released 2022-04-28

• The development server does not set Transfer-Encoding: chunked
  for 1xx, 204, 304, and HEAD responses. :issue:2375
• Response HTML for exceptions and redirects starts with
  <!doctype html> and <html lang=en>. :issue:2390
• Fix ability to set some cache_control attributes to False.
  :issue:2379
• Disable keep-alive connections in the development server, which
  are not supported sufficiently by Python's http.server.
  :issue:2397

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.