Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update werkzeug to 0.14.1 #7

wants to merge 1 commit into from


None yet
2 participants
Copy link

commented Feb 14, 2018

There's a new version of Werkzeug available.
You are currently using 0.10.4. I have updated it to 0.14.1

These links might come in handy: PyPI | Changelog | Homepage



Released on December 31st 2017

  • Resolved a regression with status code handling in the integrated
    development server.


Released on December 31st 2017

  • HTTP exceptions are now automatically caught by
  • Added support for edge as browser.
  • Added support for platforms that lack SpooledTemporaryFile.
  • Add support for etag handling through if-match
  • Added support for the SameSite cookie attribute.
  • Added werkzeug.wsgi.ProxyMiddleware
  • Implemented has for NullCache
  • get_multi on cache clients now returns lists all the time.
  • Improved the watchdog observer shutdown for the reloader to not crash
    on exit on older Python versions.
  • Added support for filename* filename attributes according to
    RFC 2231
  • Resolved an issue where machine ID for the reloader PIN was not
    read accurately on windows.
  • Added a workaround for syntax errors in init files in the reloader.
  • Added support for using the reloader with console scripts on windows.
  • The built-in HTTP server will no longer close a connection in cases
    where no HTTP body is expected (204, 204, HEAD requests etc.)
  • The EnvironHeaders object now skips over empty content type and
    lengths if they are set to falsy values.
  • Werkzeug will no longer send the content-length header on 1xx or
    204/304 responses.
  • Cookie values are now also permitted to include slashes and equal
    signs without quoting.
  • Relaxed the regex for the routing converter arguments.
  • If cookies are sent without values they are now assumed to have an
    empty value and the parser accepts this. Previously this could have
    corrupted cookies that followed the value.
  • The test Client and EnvironBuilder now support mimetypes like
    the request object does.
  • Added support for static weights in URL rules.
  • Better handle some more complex reloader scenarios where sys.path
    contained non directory paths.
  • EnvironHeaders no longer raises weird errors if non string keys
    are passed to it.


Released on December 7th 2017

  • Deprecate support for Python 2.6 and 3.3. CI tests will not run
    for these versions, and support will be dropped completely in the next
    version. (pallets/meta24_)
  • Raise TypeError when port is not an integer. (1088_)
  • Fully deprecate werkzeug.script. Use Click_ instead. (1090_)
  • response.age is parsed as a timedelta. Previously, it was
    incorrectly treated as a datetime. The header value is an integer
    number of seconds, not a date string. (414_)
  • Fix a bug in TypeConversionDict where errors are not propagated
    when using the converter. (1102_)
  • Authorization.qop is a string instead of a set, to comply with
    RFC 2617. (984_)
  • An exception is raised when an encoded cookie is larger than, by
    default, 4093 bytes. Browsers may silently ignore cookies larger than
    this. BaseResponse has a new attribute max_cookie_size and
    dump_cookie has a new argument max_size to configure this.
    (780, 1109)
  • Fix a TypeError in werkzeug.contrib.lint.GuardedIterator.close.
  • BaseResponse.calculate_content_length now correctly works for
    Unicode responses on Python 3. It first encodes using
    iter_encoded. (705_)
  • Secure cookie contrib works with string secret key on Python 3.
  • Shared data middleware accepts a list instead of a dict of static
    locations to preserve lookup order. (1197_)
  • HTTP header values without encoding can contain single quotes.
  • The built-in dev server supports receiving requests with chunked
    transfer encoding. (1198_)

.. _Click:
.. _pallets/meta24: pallets/meta#24
.. _414: pallets/werkzeug#414
.. _705: pallets/werkzeug#705
.. _780: pallets/werkzeug#780
.. _984: pallets/werkzeug#984
.. _1088: pallets/werkzeug#1088
.. _1090: pallets/werkzeug#1090
.. _1102: pallets/werkzeug#1102
.. _1109: pallets/werkzeug#1109
.. _1116: pallets/werkzeug#1116
.. _1197: pallets/werkzeug#1197
.. _1198: pallets/werkzeug#1198
.. _1205: pallets/werkzeug#1205
.. _1208: pallets/werkzeug#1208


Released on May 16 2017

  • Fix regression: Pull request 892 prevented Werkzeug from correctly
    logging the IP of a remote client behind a reverse proxy, even when using
  • Fix a bug in safe_join on Windows.


Released on March 15th 2017

  • Fix crash of reloader (used on debug mode) on Windows.
    (OSError: [WinError 10038]). See pull request 1081
  • Partially revert change to class hierarchy of Headers. See 1084.


Released on March 10th 2017

  • Spit out big deprecation warnings for werkzeug.script
  • Use inspect.getfullargspec internally when available as
    inspect.getargspec is gone in 3.6
  • Added support for status code 451 and 423
  • Improved the build error suggestions. In particular only if
    someone stringifies the error will the suggestions be calculated.
  • Added support for uWSGI's caching backend.
  • Fix a bug where iterating over a FileStorage would result in an infinite
  • Datastructures now inherit from the relevant baseclasses from the
    collections module in the stdlib. See 794.
  • Add support for recognizing NetBSD, OpenBSD, FreeBSD, DragonFlyBSD platforms
    in the user agent string.
  • Recognize SeaMonkey browser name and version correctly
  • Recognize Baiduspider, and bingbot user agents
  • If LocalProxy's wrapped object is a function, refer to it with wrapped
  • The defaults of generate_password_hash have been changed to more secure
    ones, see pull request 753.
  • Add support for encoding in options header parsing, see pull request
  • test.Client now properly handles Location headers with relative URLs, see
    pull request 879.
  • When HTTPException is raised, it now prints the description, for easier
  • Werkzeug's dict-like datastructures now have view-methods under Python 2,
    see pull request 968.
  • Fix a bug in MultiPartParser when no stream_factory was provided
    during initialization, see pull request 973.
  • Disable autocorrect and spellchecker in the debugger middleware's Python
    prompt, see pull request 994.
  • Don't redirect to slash route when method doesn't match, see pull request
  • Fix a bug when using SharedDataMiddleware with frozen packages, see pull
    request 959.
  • Range header parsing function fixed for invalid values 974.
  • Add support for byte Range Requests, see pull request 978.
  • Use modern cryptographic defaults in the dev servers 1004.
  • the post() method of the test client now accept file object through the data
  • Color run_simple's terminal output based on HTTP codes 1013.
  • Fix self-XSS in debugger console, see 1031.
  • Fix IPython 5.x shell support, see 1033.
  • Change Accept datastructure to sort by specificity first, allowing for more
    accurate results when using best_match for mime types (for example in


  • werkzeug.serving: set CONTENT_TYPE / CONTENT_LENGTH if only they're provided by the client
  • werkzeug.serving: Fix crash of reloader when using python -m werkzeug.serving.


Released on December 30th 2016.

  • Bugfix for the bugfix in the previous release.


Released on December 30th 2016.

  • Check if platform can fork before importing ForkingMixIn, raise exception
    when creating ForkingWSGIServer on such a platform, see PR 999.


Released on December 26th 2016.

  • Correct fix for the reloader issuer on certain Windows installations.


Released on December 26th 2016.

  • Fix more bugs in multidicts regarding empty lists. See 1000.
  • Add some docstrings to some EnvironBuilder properties that were previously
    unintentionally missing.
  • Added a workaround for the reloader on windows.


Released on August 31st 2016.

  • Fix JSONRequestMixin for Python3. See 731
  • Fix broken string handling in test client when passing integers. See 852
  • Fix a bug in parse_options_header where an invalid content type
    starting with comma or semi-colon would result in an invalid return value,
    see issue 995.
  • Fix a bug in multidicts when passing empty lists as values, see issue
  • Fix a security issue that allows XSS on the Werkzeug debugger. See 1001.


Released on May 24th 2016.

  • Fixed a bug that occurs when running on Python 2.6 and using a broken locale.
    See pull request 912.
  • Fixed a crash when running the debugger on Google App Engine. See issue 925.
  • Fixed an issue with multipart parsing that could cause memory exhaustion.


Released on April 24th 2016.

  • Corrected an issue that caused the debugger not to use the
    machine GUID on POSIX systems.
  • Corrected a Unicode error on Python 3 for the debugger's
    PIN usage.
  • Corrected the timestamp verification in the pin debug code.
    Without this fix the pin was remembered for too long.


Released on April 15th 2016.

  • fixed a problem with the machine GUID detection code on OS X
    on Python 3.


Released on April 14th 2016.

  • fixed a regression on Python 3 for the debugger.


Released on April 14th 2016.

  • werkzeug.serving: Still show the client address on bad requests.
  • improved the PIN based protection for the debugger to make it harder to
    brute force via trying cookies. Please keep in mind that the debugger
    is not intended for running on production environments
  • increased the pin timeout to a week to make it less annoying for people
    which should decrease the chance that users disable the pin check
  • werkzeug.serving: Fix broken HTTP_HOST when path starts with double slash.


Released on March 22nd 2016.

  • werkzeug.serving: Fix crash when attempting SSL connection to HTTP server.


Released on February 14th 2016.

  • Fixed werkzeug.serving not working from -m flag.
  • Fixed incorrect weak etag handling.


Released on December 20th 2015.

  • Fixed an issue with copy operations not working against
  • Changed the logging operations of the development server to
    correctly log where the server is running in all situations
  • Fixed another regression with SSL wrapping similar to the
    fix in 0.11.2 but for a different code path.


Released on November 12th 2015.

  • Fix inheritable sockets on Windows on Python 3.
  • Fixed an issue with the forking server not starting any longer.
  • Fixed SSL wrapping on platforms that supported opening sockets
    by file descriptor.
  • No longer log from the watchdog reloader.
  • Unicode errors in hosts are now better caught or converted into
    bad request errors.


Released on November 10th 2015.

  • Fixed a regression on Python 3 in the debugger.


Released on November 8th 2015, codename Gleisbaumaschine.

  • Added reloader_paths option to run_simple and other functions in
    werkzeug.serving. This allows the user to completely override the Python
    module watching of Werkzeug with custom paths.
  • Many custom cached properties of Werkzeug's classes are now subclasses of
    Python's property type (issue 616).
  • bind_to_environ now doesn't differentiate between implicit and explicit
    default port numbers in HTTP_HOST (pull request 204).
  • BuildErrors are now more informative. They come with a complete sentence
    as error message, and also provide suggestions (pull request 691).
  • Fix a bug in the user agent parser where Safari's build number instead of
    version would be extracted (pull request 703).
  • Fixed issue where RedisCache set_many was broken for twemproxy, which doesn't
    support the default MULTI command (pull request 702).
  • mimetype parameters on request and response classes are now always
    converted to lowercase.
  • Changed cache so that cache never expires if timeout is 0. This also fixes
    an issue with redis setex (issue 550)
  • Werkzeug now assumes UTF-8 as filesystem encoding on Unix if Python
    detected it as ASCII.
  • New optional has method on caches.
  • Fixed various bugs in parse_options_header (pull request 643).
  • If the reloader is enabled the server will now open the socket in the parent
    process if this is possible. This means that when the reloader kicks in
    the connection from client will wait instead of tearing down. This does
    not work on all Python versions.
  • Implemented PIN based authentication for the debugger. This can optionally
    be disabled but is discouraged. This change was necessary as it has been
    discovered that too many people run the debugger in production.
  • Devserver no longer requires SSL module to be installed.


(bugfix release, release date yet to be decided)

  • Reloader: Correctly detect file changes made by moving temporary files over
    the original, which is e.g. the case with PyCharm (pull request 722).
  • Fix bool behavior of werkzeug.datastructures.ETags under Python 3 (issue

Got merge conflicts? Close this PR and delete the branch. I'll create a new PR for you.

Happy merging! 🤖

This change is Reviewable

@gozer gozer closed this Apr 27, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.