You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
Fix type hint for cli_runner.invoke. :issue:5645
flask --help loads the app and plugins first to make sure all commands
are shown. :issue:5673
Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier
for Quart. :pr:5659
Provide a configuration option to control automatic option
responses. :pr:5496
Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when
opening in text mode. It defaults to utf-8. :issue:5504
Request.max_content_length can be customized per-request instead of only
through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation
about resource limits to the security page. :issue:5625
Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. :issue:5472
-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. :issue:5628
Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
secret keys that can still be used for unsigning. Extensions will need to
add support. :issue:5621
Fix how setting host_matching=True or subdomain_matching=False
interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts
requests to only that domain. :issue:5553
Request.trusted_hosts is checked during routing, and can be set through
the TRUSTED_HOSTS config. :issue:5636
Configuration
📅 Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
Review comments: Directly reply to a review comment made by CodeRabbit. Example:
I pushed a fix in commit <commit_id>, please review it.
Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
Support
Need help? Join our Discord community for assistance with any issues or questions.
CodeRabbit Commands (Invoked using PR/Issue comments)
Type @coderabbitai help to get the list of available commands.
Other keywords and placeholders
Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.
CodeRabbit Configuration File (.coderabbit.yaml)
You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
Status, Documentation and Community
Visit our Status Page to check the current availability of CodeRabbit.
Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.
renovateBot
changed the title
chore(deps): update dependency flask to ~=3.1.3
Update dependency flask to ~=3.1.3
Apr 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~=3.0.2→~=3.1.3Release Notes
pallets/flask (flask)
v3.1.3Compare Source
Released 2026-02-18
but not the values, such as
inandlen. :ghsa:68rp-wp8r-4726v3.1.2Compare Source
Released 2025-08-19
stream_with_contextdoes not fail inside async views. :issue:5774follow_redirectsin the test client, the final stateof
sessionis correct. :issue:5786send_file. :issue:5776v3.1.1Compare Source
Released 2025-05-13
SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28gcli_runner.invoke. :issue:5645flask --helploads the app and plugins first to make sure all commandsare shown. :issue:
5673AsyncIterable. This is not accurate for Flask, but makes typing easierfor Quart. :pr:
5659v3.1.0Compare Source
Released 2024-11-13
5623Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:
5624,5633responses. :pr:
5496Flask.open_resource/open_instance_resourceandBlueprint.open_resourcetake anencodingparameter to use whenopening in text mode. It defaults to
utf-8. :issue:5504Request.max_content_lengthcan be customized per-request instead of onlythrough the
MAX_CONTENT_LENGTHconfig. AddedMAX_FORM_MEMORY_SIZEandMAX_FORM_PARTSconfig. Added documentationabout resource limits to the security page. :issue:
5625Partitionedcookie attribute (CHIPS), with theSESSION_COOKIE_PARTITIONEDconfig. :issue:5472-e pathtakes precedence over default.envand.flaskenvfiles.load_dotenvloads default files in addition to a path unlessload_defaults=Falseis passed. :issue:5628SECRET_KEY_FALLBACKSconfig, a list of oldsecret keys that can still be used for unsigning. Extensions will need to
add support. :issue:
5621host_matching=Trueorsubdomain_matching=Falseinteracts with
SERVER_NAME. SettingSERVER_NAMEno longer restrictsrequests to only that domain. :issue:
5553Request.trusted_hostsis checked during routing, and can be set throughthe
TRUSTED_HOSTSconfig. :issue:5636Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.