chore(deps): bump the pip group across 19 directories with 12 updates by dependabot[bot] · Pull Request #5 · cvsz/python-docs-samples

dependabot · 2026-04-13T21:12:50Z

Bumps the pip group with 4 updates in the /composer/airflow_1_samples directory: flask, werkzeug, cryptography and protobuf.
Bumps the pip group with 9 updates in the /composer/cicd_sample directory:

Package	From	To
flask	`2.2.5`	`3.1.3`
werkzeug	`2.2.3`	`3.1.6`
black	`23.1a1`	`26.3.1`
cryptography	`40.0.2`	`46.0.7`
protobuf	`4.23.4`	`5.29.6`
pytest	`7.4.0`	`9.0.3`
requests	`2.31.0`	`2.33.0`
apache-airflow	`2.6.3`	`3.2.0`
google-cloud-aiplatform	`1.27.1`	`1.133.0`

Bumps the pip group with 2 updates in the /composer/rest directory: pytest and requests.
Bumps the pip group with 9 updates in the /composer/workflows directory:

Package	From	To
flask	`2.2.5`	`3.1.3`
werkzeug	`2.2.3`	`3.1.6`
black	`24.4.2`	`26.3.1`
cryptography	`41.0.7`	`46.0.7`
protobuf	`4.25.3`	`5.29.6`
pytest	`7.4.4`	`9.0.3`
requests	`2.31.0`	`2.33.0`
apache-airflow	`2.9.2`	`3.2.0`
google-cloud-aiplatform	`1.53.0`	`1.133.0`

Bumps the pip group with 2 updates in the /compute/auth directory: pytest and requests.
Bumps the pip group with 2 updates in the /compute/client_library directory: black and pytest.
Bumps the pip group with 3 updates in the /compute/encryption directory: cryptography, pytest and requests.
Bumps the pip group with 2 updates in the /compute/metadata directory: pytest and requests.
Bumps the pip group with 2 updates in the /compute/oslogin directory: pytest and requests.
Bumps the pip group with 4 updates in the /dataflow/gemma directory: protobuf, pytest, google-cloud-aiplatform and keras.
Bumps the pip group with 2 updates in the /dataflow/gemma-flex-template directory: pytest and google-cloud-aiplatform.
Bumps the pip group with 4 updates in the /dataflow/run-inference directory: pytest, google-cloud-aiplatform, torch and transformers.
Bumps the pip group with 1 update in the /dataflow/run_template directory: flask.
Bumps the pip group with 3 updates in the /datastore/cloud-ndb directory: flask, werkzeug and pytest.
Bumps the pip group with 3 updates in the /dialogflow directory: flask, werkzeug and pytest.
Bumps the pip group with 3 updates in the /dialogflow-cx directory: flask, werkzeug and pytest.
Bumps the pip group with 3 updates in the /gemma2 directory: protobuf, pytest and google-cloud-aiplatform.
Bumps the pip group with 5 updates in the /iap directory:

Package	From	To
flask	`3.0.3`	`3.1.3`
werkzeug	`3.0.3`	`3.1.6`
cryptography	`45.0.1`	`46.0.7`
pytest	`8.2.0`	`9.0.3`
requests	`2.32.4`	`2.33.0`

Bumps the pip group with 2 updates in the /media_cdn directory: cryptography and pytest.

Updates flask from 1.1.2 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

3.0.3

... (truncated)

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates werkzeug from 0.16.1 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1

Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. #2994

When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. #2993

3.1.2

This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.1.6

Released 2026-02-19

safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x

Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. :issue:3075

Version 3.1.4

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. :ghsa:hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. :pr:3020

The multipart form parser handles a \r\n sequence at a chunk boundary. :issue:3065

Improve CPU usage during Watchdog reloader. :issue:3054

Request.json annotation is more accurate. :issue:3067

Traceback rendering handles when the line number is beyond the available source lines. :issue:3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056

Version 3.1.3

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts

... (truncated)

Commits

04da1b5 release version 3.1.6
f407712 Merge commit from fork
f54fe98 safe_join prevents Windows special device names in multi-segment paths
d005985 start version 3.1.6
8565c2c document rule priority (#3102)
3febc7e document rule priority
2525b82 remove state machine docs
4abfbd5 rewrite build docstring (#3097)
161c18b rewrite build docstring
86e11c2 release version 3.1.5 (#3085)
Additional commits viewable in compare view

Updates cryptography from 3.2.1 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10
* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27
Dropped support for win_arm64 wheels_.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15
* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

</tr></table>

... (truncated)

Commits

622d672 46.0.7 release (#14602)
91d7288 Cherry-pick #14542 (#14543)
06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
Additional commits viewable in compare view

Updates protobuf from 3.14.0 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates flask from 2.2.5 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

3.0.3

... (truncated)

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates werkzeug from 2.2.3 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1

Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. #2994

When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. #2993

3.1.2

This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.1.6

Released 2026-02-19

safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x

Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. :issue:3075

Version 3.1.4

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. :ghsa:hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. :pr:3020

The multipart form parser handles a \r\n sequence at a chunk boundary. :issue:3065

Improve CPU usage during Watchdog reloader. :issue:3054

Request.json annotation is more accurate. :issue:3067

Traceback rendering handles when the line number is beyond the available source lines. :issue:3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056

Version 3.1.3

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts

... (truncated)

Commits

04da1b5 release version 3.1.6
f407712 Merge commit from fork
f54fe98 safe_join prevents Windows special device names in multi-segment paths
d005985 start version 3.1.6
8565c2c document rule priority (#3102)
3febc7e document rule priority
2525b82 remove state machine docs
4abfbd5 rewrit...
Description has been truncated

Bumps the pip group with 4 updates in the /composer/airflow_1_samples directory: [flask](https://github.com/pallets/flask), [werkzeug](https://github.com/pallets/werkzeug), [cryptography](https://github.com/pyca/cryptography) and [protobuf](https://github.com/protocolbuffers/protobuf). Bumps the pip group with 9 updates in the /composer/cicd_sample directory: | Package | From | To | | --- | --- | --- | | [flask](https://github.com/pallets/flask) | `2.2.5` | `3.1.3` | | [werkzeug](https://github.com/pallets/werkzeug) | `2.2.3` | `3.1.6` | | [black](https://github.com/psf/black) | `23.1a1` | `26.3.1` | | [cryptography](https://github.com/pyca/cryptography) | `40.0.2` | `46.0.7` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `4.23.4` | `5.29.6` | | [pytest](https://github.com/pytest-dev/pytest) | `7.4.0` | `9.0.3` | | [requests](https://github.com/psf/requests) | `2.31.0` | `2.33.0` | | [apache-airflow](https://github.com/apache/airflow) | `2.6.3` | `3.2.0` | | [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) | `1.27.1` | `1.133.0` | Bumps the pip group with 2 updates in the /composer/rest directory: [pytest](https://github.com/pytest-dev/pytest) and [requests](https://github.com/psf/requests). Bumps the pip group with 9 updates in the /composer/workflows directory: | Package | From | To | | --- | --- | --- | | [flask](https://github.com/pallets/flask) | `2.2.5` | `3.1.3` | | [werkzeug](https://github.com/pallets/werkzeug) | `2.2.3` | `3.1.6` | | [black](https://github.com/psf/black) | `24.4.2` | `26.3.1` | | [cryptography](https://github.com/pyca/cryptography) | `41.0.7` | `46.0.7` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `4.25.3` | `5.29.6` | | [pytest](https://github.com/pytest-dev/pytest) | `7.4.4` | `9.0.3` | | [requests](https://github.com/psf/requests) | `2.31.0` | `2.33.0` | | [apache-airflow](https://github.com/apache/airflow) | `2.9.2` | `3.2.0` | | [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) | `1.53.0` | `1.133.0` | Bumps the pip group with 2 updates in the /compute/auth directory: [pytest](https://github.com/pytest-dev/pytest) and [requests](https://github.com/psf/requests). Bumps the pip group with 2 updates in the /compute/client_library directory: [black](https://github.com/psf/black) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 3 updates in the /compute/encryption directory: [cryptography](https://github.com/pyca/cryptography), [pytest](https://github.com/pytest-dev/pytest) and [requests](https://github.com/psf/requests). Bumps the pip group with 2 updates in the /compute/metadata directory: [pytest](https://github.com/pytest-dev/pytest) and [requests](https://github.com/psf/requests). Bumps the pip group with 2 updates in the /compute/oslogin directory: [pytest](https://github.com/pytest-dev/pytest) and [requests](https://github.com/psf/requests). Bumps the pip group with 4 updates in the /dataflow/gemma directory: [protobuf](https://github.com/protocolbuffers/protobuf), [pytest](https://github.com/pytest-dev/pytest), [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) and [keras](https://github.com/keras-team/keras). Bumps the pip group with 2 updates in the /dataflow/gemma-flex-template directory: [pytest](https://github.com/pytest-dev/pytest) and [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform). Bumps the pip group with 4 updates in the /dataflow/run-inference directory: [pytest](https://github.com/pytest-dev/pytest), [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform), [torch](https://github.com/pytorch/pytorch) and [transformers](https://github.com/huggingface/transformers). Bumps the pip group with 1 update in the /dataflow/run_template directory: [flask](https://github.com/pallets/flask). Bumps the pip group with 3 updates in the /datastore/cloud-ndb directory: [flask](https://github.com/pallets/flask), [werkzeug](https://github.com/pallets/werkzeug) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 3 updates in the /dialogflow directory: [flask](https://github.com/pallets/flask), [werkzeug](https://github.com/pallets/werkzeug) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 3 updates in the /dialogflow-cx directory: [flask](https://github.com/pallets/flask), [werkzeug](https://github.com/pallets/werkzeug) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 3 updates in the /gemma2 directory: [protobuf](https://github.com/protocolbuffers/protobuf), [pytest](https://github.com/pytest-dev/pytest) and [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform). Bumps the pip group with 5 updates in the /iap directory: | Package | From | To | | --- | --- | --- | | [flask](https://github.com/pallets/flask) | `3.0.3` | `3.1.3` | | [werkzeug](https://github.com/pallets/werkzeug) | `3.0.3` | `3.1.6` | | [cryptography](https://github.com/pyca/cryptography) | `45.0.1` | `46.0.7` | | [pytest](https://github.com/pytest-dev/pytest) | `8.2.0` | `9.0.3` | | [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` | Bumps the pip group with 2 updates in the /media_cdn directory: [cryptography](https://github.com/pyca/cryptography) and [pytest](https://github.com/pytest-dev/pytest). Updates `flask` from 1.1.2 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 0.16.1 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `cryptography` from 3.2.1 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `protobuf` from 3.14.0 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `flask` from 2.2.5 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 2.2.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `black` from 23.1a1 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/commits/26.3.1) Updates `cryptography` from 40.0.2 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `protobuf` from 4.23.4 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pytest` from 7.4.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.31.0 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `apache-airflow` from 2.6.3 to 3.2.0 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@2.6.3...3.2.0) Updates `google-cloud-aiplatform` from 1.27.1 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.2 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `flask` from 2.2.5 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 2.2.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `black` from 24.4.2 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/commits/26.3.1) Updates `cryptography` from 41.0.7 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `protobuf` from 4.25.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pytest` from 7.4.4 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.31.0 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `apache-airflow` from 2.9.2 to 3.2.0 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@2.6.3...3.2.0) Updates `google-cloud-aiplatform` from 1.53.0 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `black` from 24.10.0 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](https://github.com/psf/black/commits/26.3.1) Updates `pytest` from 8.3.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `cryptography` from 45.0.1 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `protobuf` from 4.25.0 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pytest` from 7.4.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `google-cloud-aiplatform` from 1.49.0 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `keras` from 3.0.5 to 3.13.2 - [Release notes](https://github.com/keras-team/keras/releases) - [Commits](keras-team/keras@v3.0.5...v3.13.2) Updates `pytest` from 8.3.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `google-cloud-aiplatform` from 1.62.0 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `google-cloud-aiplatform` from 1.57.0 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `torch` from 2.2.2 to 2.8.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.2.2...v2.8.0) Updates `transformers` from 4.38.0 to 5.0.0rc3 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v4.38.0...v5.0.0rc3) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `protobuf` from 5.29.5 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pytest` from 8.3.3 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `google-cloud-aiplatform` from 1.64.0 to 1.133.0 - [Release notes](https://github.com/googleapis/python-aiplatform/releases) - [Changelog](https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md) - [Commits](googleapis/python-aiplatform@v1.27.1...v1.133.0) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@1.1.2...3.1.3) Updates `werkzeug` from 3.0.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@0.16.1...3.1.6) Updates `cryptography` from 45.0.1 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.33.0) Updates `cryptography` from 45.0.1 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@3.2.1...46.0.7) Updates `pytest` from 8.2.0 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@7.4.0...9.0.3) --- updated-dependencies: - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.3.1 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: apache-airflow dependency-version: 3.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.3.1 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: apache-airflow dependency-version: 3.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.3.1 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: keras dependency-version: 3.13.2 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-version: 2.8.0 dependency-type: direct:production dependency-group: pip - dependency-name: transformers dependency-version: 5.0.0rc3 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: google-cloud-aiplatform dependency-version: 1.133.0 dependency-type: direct:production dependency-group: pip - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: pip - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-13T22:06:53Z

Superseded by #6.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 13, 2026

dependabot Bot mentioned this pull request Apr 13, 2026

chore(deps): bump the pip group across 19 directories with 11 updates #4

Closed

dependabot Bot closed this Apr 13, 2026

dependabot Bot deleted the dependabot/pip/composer/airflow_1_samples/pip-5ec69f617e branch April 13, 2026 22:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the pip group across 19 directories with 12 updates#5

chore(deps): bump the pip group across 19 directories with 12 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/composer/airflow_1_samples/pip-5ec69f617e

dependabot Bot commented on behalf of github Apr 13, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 13, 2026

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

3.1.6

3.1.5

3.1.4

3.1.3

3.1.2

Version 3.1.6

Version 3.1.5

Version 3.1.4

Version 3.1.3

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

3.1.6

3.1.5

3.1.4

3.1.3

3.1.2

Version 3.1.6

Version 3.1.5

Version 3.1.4

Version 3.1.3

Uh oh!

dependabot Bot commented on behalf of github Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants