i suspect a potential use case lingering in lazy code loaders that inject modules into sys.modules at their own import

on closer examination the internal logic is grown a bit strange and should probably do a different loop altogether

We can preserve the "not set up by parent" case by saving the exception and raising it in the AttributeError block. However, this just adds more complexity to a code path no one can reproduce. And it makes the chained traceback in Python 3 look like it's coming from the wrong place. I'm inclined to merge this PR as-is, leaving this diff as a note in case someone comes up with a failing test case.

diff --git a/werkzeug/utils.py b/werkzeug/utils.py
index 5c8f5125..b3e859f7 100644
--- a/werkzeug/utils.py
+++ b/werkzeug/utils.py
@@ -423,10 +423,17 @@ def import_string(import_name, silent=False):
             return sys.modules[import_name]
 
         module_name, obj_name = import_name.rsplit('.', 1)
-        module = __import__(module_name, globals(), locals(), [obj_name])
+        preserved_import_error = None
+        try:
+            module = __import__(module_name, globals(), locals(), [obj_name])
+        except ImportError as e:
+            preserved_import_error = e
+            module = import_string(module_name)
         try:
             return getattr(module, obj_name)
         except AttributeError as e:
+            if preserved_import_error is not None:
+                raise preserved_import_error
             raise ImportError(e)
 
     except ImportError as e:

Nearly three and a half years later, I still vividly recall the dozens of hours of pain that this was helping solve for the (now-deprecated) referenced module. Thanks for the merge. I hope it helps people get useful tracebacks.

Sorry it took so long 😞 It came up in a much more recent issue, so it will still help. Thanks for working on it.