Merge branch 'stable'

davidism · davidism · commit 6a2f545bfd8e · 2026-07-30T10:29:33.000-07:00
diff --git a/.github/workflows/lock.yaml b/.github/workflows/lock.yaml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
       discussions: write
     steps:
-      - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
+      - uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           issue-inactive-days: 14
           pr-inactive-days: 14
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
@@ -11,18 +11,18 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           prune-cache: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         id: setup-python
         with:
           python-version-file: pyproject.toml
-      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ hashFiles('pyproject.toml', '.pre-commit-config.yaml') }}
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
@@ -12,19 +12,19 @@ jobs:
     outputs:
       artifact-id: ${{ steps.upload-artifact.outputs.artifact-id }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: false
           prune-cache: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version-file: pyproject.toml
       - run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
       - run: uv build
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: upload-artifact
         with:
           name: dist
@@ -57,6 +57,6 @@ jobs:
         with:
           artifact-ids: ${{ needs.build.outputs.artifact-id }}
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: "dist/"
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
@@ -17,6 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - {python: '3.15'}
           - {python: '3.14'}
           - {python: '3.14t'}
           - {name: Windows, python: '3.14', os: windows-latest}
@@ -29,34 +30,35 @@ jobs:
           - {name: Minimum Versions, python: '3.14', tox: tests-min}
           - {name: Development Versions, python: '3.10', tox: tests-dev}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           prune-cache: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python }}
+          allow-prereleases: true
       - run: uv run --locked --no-default-groups --group dev tox run
         env:
           TOX_ENV: ${{ matrix.tox || format('py{0}', matrix.python) }}
   typing:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           enable-cache: true
           prune-cache: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version-file: pyproject.toml
       - name: cache mypy
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ./.mypy_cache
           key: mypy|${{ hashFiles('pyproject.toml') }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
@@ -13,10 +13,10 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+      - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
         with:
           advanced-security: false
           annotations: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,18 +1,19 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 5e2fb545eba1ea9dc051f6f962d52fe8f76a9794  # frozen: v0.15.13
+    rev: cb8c523fd4835aba42af70f4cad5568db4df0b6c  # frozen: v0.16.0
     hooks:
       - id: ruff-check
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: fa60a193803535a9e2accdb3ca4b1b584b1150cb  # frozen: 0.11.15
+    rev: 5900cba2cfe6d20f562458d4d308ac55569f92eb  # frozen: 0.12.0
     hooks:
       - id: uv-lock
   - repo: https://github.com/codespell-project/codespell
-    rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a  # frozen: v2.4.2
+    rev: 57b21406f092110c18776e39b0bda50d37c945c8  # frozen: v2.4.3
     hooks:
       - id: codespell
-        args: ['--write-changes']
+        additional_dependencies:
+          - tomli
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
diff --git a/examples/celery/pyproject.toml b/examples/celery/pyproject.toml
@@ -15,3 +15,8 @@ name = "task_app"
 
 [tool.ruff]
 src = ["src"]
+
+[tool.ruff.lint.isort]
+force-single-line = true
+order-by-type = false
+known-first-party = ["task_app"]
diff --git a/examples/celery/src/task_app/__init__.py b/examples/celery/src/task_app/__init__.py
@@ -7,11 +7,11 @@
 def create_app() -> Flask:
     app = Flask(__name__)
     app.config.from_mapping(
-        CELERY=dict(
-            broker_url="redis://localhost",
-            result_backend="redis://localhost",
-            task_ignore_result=True,
-        ),
+        CELERY={
+            "broker_url": "redis://localhost",
+            "result_backend": "redis://localhost",
+            "task_ignore_result": True,
+        },
     )
     app.config.from_prefixed_env()
     celery_init_app(app)
diff --git a/examples/javascript/js_example/__init__.py b/examples/javascript/js_example/__init__.py
@@ -2,4 +2,4 @@
 
 app = Flask(__name__)
 
-from js_example import views  # noqa: E402, F401
+from js_example import views  # noqa: F401
diff --git a/examples/javascript/pyproject.toml b/examples/javascript/pyproject.toml
@@ -31,3 +31,8 @@ source = ["js_example", "tests"]
 
 [tool.ruff]
 src = ["src"]
+
+[tool.ruff.lint.isort]
+force-single-line = true
+order-by-type = false
+known-first-party = ["js_example"]
diff --git a/examples/tutorial/pyproject.toml b/examples/tutorial/pyproject.toml
@@ -38,3 +38,8 @@ source = ["flaskr", "tests"]
 
 [tool.ruff]
 src = ["src"]
+
+[tool.ruff.lint.isort]
+force-single-line = true
+order-by-type = false
+known-first-party = ["flaskr"]
diff --git a/pyproject.toml b/pyproject.toml
@@ -169,6 +169,7 @@ ignore-words-list = "te"
 
 [tool.tox]
 env_list = [
+    "py3.15",
     "py3.14", "py3.14t",
     "py3.13", "py3.12", "py3.11", "py3.10",
     "pypy3.11",
diff --git a/src/flask/cli.py b/src/flask/cli.py
@@ -777,7 +777,7 @@ def show_server_banner(debug: bool, app_import_path: str | None) -> None:
         click.echo(f" * Debug mode: {'on' if debug else 'off'}")
 
 
-class CertParamType(click.ParamType[t.Any]):
+class CertParamType(click.ParamType):  # type: ignore[type-arg]
     """Click option type for the ``--cert`` option. Allows either an
     existing file, the string ``'adhoc'``, or an import for a
     :class:`~ssl.SSLContext` object.
diff --git a/tests/conftest.py b/tests/conftest.py
@@ -2,43 +2,26 @@
 import sys
 
 import pytest
-from _pytest import monkeypatch
 
 from flask import Flask
 from flask.globals import app_ctx as _app_ctx
 
 
-@pytest.fixture(scope="session", autouse=True)
-def _standard_os_environ():
-    """Set up ``os.environ`` at the start of the test session to have
-    standard values. Returns a list of operations that is used by
-    :func:`._reset_os_environ` after each test.
-    """
-    mp = monkeypatch.MonkeyPatch()
-    out = (
-        (os.environ, "FLASK_ENV_FILE", monkeypatch.notset),
-        (os.environ, "FLASK_APP", monkeypatch.notset),
-        (os.environ, "FLASK_DEBUG", monkeypatch.notset),
-        (os.environ, "FLASK_RUN_FROM_CLI", monkeypatch.notset),
-        (os.environ, "WERKZEUG_RUN_MAIN", monkeypatch.notset),
-    )
-
-    for _, key, value in out:
-        if value is monkeypatch.notset:
-            mp.delenv(key, False)
-        else:
-            mp.setenv(key, value)
-
-    yield out
-    mp.undo()
-
-
 @pytest.fixture(autouse=True)
-def _reset_os_environ(monkeypatch, _standard_os_environ):
-    """Reset ``os.environ`` to the standard environ after each test,
-    in case a test changed something without cleaning up.
+def _standard_os_environ(monkeypatch):
+    """Set up ``os.environ`` at the start of every test to have
+    standard values.
     """
-    monkeypatch._setitem.extend(_standard_os_environ)
+    for key in (
+        "FLASK_ENV_FILE",
+        "FLASK_APP",
+        "FLASK_DEBUG",
+        "FLASK_RUN_FROM_CLI",
+        "WERKZEUG_RUN_MAIN",
+    ):
+        monkeypatch.delenv(key, False)
+
+    yield
 
 
 @pytest.fixture
diff --git a/tests/test_cli.py b/tests/test_cli.py
@@ -11,7 +11,6 @@
 
 import click
 import pytest
-from _pytest.monkeypatch import notset
 from click.testing import CliRunner
 
 from flask import Blueprint
@@ -535,9 +534,8 @@ def dotenv_not_available():
 
 @need_dotenv
 def test_load_dotenv(monkeypatch):
-    # can't use monkeypatch.delitem since the keys don't exist yet
     for item in ("FOO", "BAR", "SPAM", "HAM"):
-        monkeypatch._setitem.append((os.environ, item, notset))
+        monkeypatch.delenv(item, False)
 
     monkeypatch.setenv("EGGS", "3")
     monkeypatch.chdir(test_path)
@@ -560,14 +558,15 @@ def test_load_dotenv(monkeypatch):
 @need_dotenv
 def test_dotenv_path(monkeypatch):
     for item in ("FOO", "BAR", "EGGS"):
-        monkeypatch._setitem.append((os.environ, item, notset))
+        monkeypatch.delenv(item, False)
 
     load_dotenv(test_path / ".flaskenv")
     assert Path.cwd() == cwd
     assert "FOO" in os.environ
 
 
 def test_dotenv_optional(monkeypatch):
+    monkeypatch.delenv("FOO", False)
     monkeypatch.setitem(sys.modules, "dotenv", None)
     monkeypatch.chdir(test_path)
     load_dotenv()
@@ -576,6 +575,7 @@ def test_dotenv_optional(monkeypatch):
 
 @need_dotenv
 def test_disable_dotenv_from_env(monkeypatch, runner):
+    monkeypatch.delenv("FOO", False)
     monkeypatch.chdir(test_path)
     monkeypatch.setitem(os.environ, "FLASK_SKIP_DOTENV", "1")
     runner.invoke(FlaskGroup())
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -2,4 +2,4 @@`
`2`	`2`
`3`	`3`	`app = Flask(__name__)`
`4`	`4`
`5`		`-from js_example import views # noqa: E402, F401`
	`5`	`+from js_example import views # noqa: F401`