Skip to content

chore(deps): update dependency flask-cors to v6 #13378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

chore(deps): update dependency flask-cors to v6 #13378

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion endpoints/getting-started/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Flask==3.0.3
flask-cors==6.0.0; python_version >= "3.9"
flask-cors==5.0.0; python_version == "3.8"
flask-cors==6.0.0; python_version == "3.8"
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot May 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Updating flask-cors to v6.0.0 for Python 3.8 aligns it with newer Python versions and brings in security updates, which is good.

However, please be aware of the breaking changes introduced in flask-cors v6.0.0, as noted in their release notes:

  1. Path Specificity Ordering Changed: "Path specificity ordering has changed to improve specificity. This may break users who expected the previous incorrect ordering."

    • While the routes in main.py (/echo, /auth/info/googlejwt, etc.) are distinct, it's worth ensuring that this change doesn't inadvertently affect how CORS is applied if there were any subtle reliance on the old ordering (though unlikely with the current simple paths).

  2. Case Sensitive Request Path Matching (CVE-2024-6866): "Case Sensitive Request Path Matching."

    • This is a key change. The /auth/info/firebase endpoint uses @cross_origin. If clients were previously accessing this path with different casings (e.g., /auth/info/Firebase) and relying on case-insensitive matching for CORS headers, this will no longer work. CORS rules will now strictly match the defined path's case.
    • The existing test test_cors in main_test.py correctly uses the lowercase path /auth/info/firebase. This is good, but ensure that real-world usage or documentation for this sample emphasizes case-sensitive URLs for CORS-enabled endpoints.

  3. Security Fixes (CVE-2024-6839, CVE-2024-6844): These are beneficial security improvements.

Could you please confirm that these breaking changes, particularly the case-sensitive path matching for /auth/info/firebase, have been considered and that the application's behavior (and any associated client expectations for this sample) remains correct after this update? Ensuring tests cover these aspects, especially if case-insensitivity was implicitly relied upon, would be beneficial.

gunicorn==23.0.0
six==1.16.0
pyyaml==6.0.2
Expand Down