chore(deps): update dependency werkzeug to v3.1.4 [security]

[descope]

This PR contains the following updates:

Package	Update	Change	OpenSSF
Werkzeug (changelog)	patch	==3.1.3 -> ==3.1.4

GitHub Vulnerability Alerts

CVE-2025-66221

Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

---

Werkzeug safe_join() allows Windows special device names

CVE-2025-66221 / GHSA-hgf8-39gv-g3f2

More information

Details

Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221
• https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13
• https://github.com/pallets/werkzeug
• https://github.com/pallets/werkzeug/releases/tag/3.1.4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/werkzeug (Werkzeug)

v3.1.4

Compare Source

Released 2025-11-28

• safe_join on Windows does not allow special device names. This prevents
  reading from these when using send_from_directory. secure_filename
  already prevented writing to these. :ghsa:hgf8-39gv-g3f2
• The debugger pin fails after 10 attempts instead of 11. :pr:3020
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  :issue:3065
• Improve CPU usage during Watchdog reloader. :issue:3054
• Request.json annotation is more accurate. :issue:3067
• Traceback rendering handles when the line number is beyond the available
  source lines. :issue:3044
• HTTPException.get_response annotation and doc better conveys the
  distinction between WSGI and sans-IO responses. :issue:3056

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Jerusalem, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

Coverage report

The coverage rate went from 98.18% to 98.18% ➡️

None of the new lines are part of the tested code. Therefore, there is no coverage data about them.