Bumps flask from 0.10.1 to 1.0. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.*
> **Low severity vulnerability that affects flask**
> The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1.
>
> Affected versions: < 1.0.0
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects flask**
> The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
>
> Affected versions: < 0.12.3
Release notes
*Sourced from [flask's releases](https://github.com/pallets/flask/releases).*
> ## 1.0
> The Pallets team is pleased to release Flask 1.0. [Read the announcement on our blog.](https://www.palletsprojects.com/blog/flask-1-0-released/
>
> There are over a year's worth of changes in this release. Many features have been improved or changed. [Read the changelog](http://flask.pocoo.org/docs/1.0/changelog/) to understand how your project's code will be affected.
>
>
> JSON Security Fix
> ------------------
>
> Flask previously decoded incoming JSON bytes using the content type of the request. Although JSON should only be encoded as UTF-8, Flask was more lenient. However, Python includes non-text related encodings that could result in unexpected memory use by a request.
>
> Flask will now detect the encoding of incoming JSON data as one of the supported UTF encodings, and will not allow arbitrary encodings from the request.
>
>
> Install or Upgrade
> -------------------
>
> Install from [PyPI](https://pypi.org/project/Flask/) with pip:
>
> pip install -U Flask
>
> ## 0.12.4
> This is a repackage of [0.12.3](https://github.com/pallets/flask/releases/0.12.3) to fix an issue with how the package was built.
>
>
> Upgrade
> --------
>
> Upgrade from [PyPI](https://pypi.org/project/Flask/0.12.4/) with pip. Use a version identifier if you want to stay at 0.12:
>
> pip install -U 'Flask~=0.12.4'
>
> ## 0.12.3
> This release includes an important security fix for JSON and a minor backport for CLI support in PyCharm. It is provided for projects that cannot update to Flask 1.0 immediately. See the [1.0 announcement](https://github.com/pallets/flask/blob/flask-1-0-released) and update to it instead if possible.
>
>
> JSON Security Fix
> ------------------
>
> Flask previously decoded incoming JSON bytes using the content type of the request. Although JSON should only be encoded as UTF-8, Flask was more lenient. However, Python includes non-text related encodings that could result in unexpected memory use by a request.
>
> Flask will now detect the encoding of incoming JSON data as one of the supported UTF encodings, and will not allow arbitrary encodings from the request.
>
>
> Upgrade
> --------
>
> Upgrade from [PyPI](https://pypi.org/project/Flask/) with pip. Use a version identifier if you want to stay at 0.12:
>
> pip install -U 'Flask~=0.12.3'
> ... (truncated)
Changelog
*Sourced from [flask's changelog](https://github.com/pallets/flask/blob/master/CHANGES.rst).*
> Version 1.0
> ===========
>
> Released 2018-04-26
>
> - Python 2.6 and 3.3 are no longer supported.
> - Bump minimum dependency versions to the latest stable versions: Werkzeug >= 0.14, Jinja >= 2.10, itsdangerous >= 0.24, Click >= 5.1. 2586
> - Skip app.run <Flask.run> when a Flask application is run from the command line. This avoids some behavior that was confusing to debug.
> - Change the default for JSONIFY\_PRETTYPRINT\_REGULAR to `False`. \~json.jsonify returns a compact format by default, and an indented format in debug mode. 2193
> - Flask.\_\_init\_\_ <Flask> accepts the `host_matching` argument and sets it on \~Flask.url\_map. 1559
> - Flask.\_\_init\_\_ <Flask> accepts the `static_host` argument and passes it as the `host` argument when defining the static route. 1559
> - send\_file supports Unicode in `attachment_filename`. 2223
> - Pass `_scheme` argument from url\_for to \~Flask.handle\_url\_build\_error. 2017
> - \~Flask.add\_url\_rule accepts the `provide_automatic_options` argument to disable adding the `OPTIONS` method. 1489
> - \~views.MethodView subclasses inherit method handlers from base classes. 1936
> - Errors caused while opening the session at the beginning of the request are handled by the app's error handlers. 2254
> - Blueprints gained \~Blueprint.json\_encoder and \~Blueprint.json\_decoder attributes to override the app's encoder and decoder. 1898
> - Flask.make\_response raises `TypeError` instead of `ValueError` for bad response types. The error messages have been improved to describe why the type is invalid. 2256
> - Add `routes` CLI command to output routes registered on the application. 2259
> - Show warning when session cookie domain is a bare hostname or an IP address, as these may not behave properly in some browsers, such as Chrome. 2282
> - Allow IP address as exact session cookie domain. 2282
> - `SESSION_COOKIE_DOMAIN` is set if it is detected through `SERVER_NAME`. 2282
> - Auto-detect zero-argument app factory called `create_app` or `make_app` from `FLASK_APP`. 2297
> - Factory functions are not required to take a `script_info` parameter to work with the `flask` command. If they take a single parameter or a parameter named `script_info`, the \~cli.ScriptInfo object will be passed. 2319
> - `FLASK_APP` can be set to an app factory, with arguments if needed, for example `FLASK_APP=myproject.app:create_app('dev')`. 2326
> - `FLASK_APP` can point to local packages that are not installed in editable mode, although `pip install -e` is still preferred. 2414
> - The \~views.View class attribute \~views.View.provide\_automatic\_options is set in \~views.View.as\_view, to be detected by \~Flask.add\_url\_rule. 2316
> - Error handling will try handlers registered for `blueprint, code`, `app, code`, `blueprint, exception`, `app, exception`. 2314
> - `Cookie` is added to the response's `Vary` header if the session is accessed at all during the request (and not deleted). 2288
> - \~Flask.test\_request\_context accepts `subdomain` and `url_scheme` arguments for use when building the base URL. 1621
> - Set APPLICATION\_ROOT to `'/'` by default. This was already the implicit default when it was set to `None`.
> - TRAP\_BAD\_REQUEST\_ERRORS is enabled by default in debug mode. `BadRequestKeyError` has a message with the bad key in debug mode instead of the generic bad request message. 2348
> - Allow registering new tags with \~json.tag.TaggedJSONSerializer to support storing other types in the session cookie. 2352
> - Only open the session if the request has not been pushed onto the context stack yet. This allows \~stream\_with\_context generators to access the same session that the containing view uses. 2354
> - Add `json` keyword argument for the test client request methods. This will dump the given object as JSON and set the appropriate content type. 2358
> - Extract JSON handling to a mixin applied to both the Request and Response classes. This adds the \~Response.is\_json and \~Response.get\_json methods to the response to make testing JSON response much easier. 2358
> - Removed error handler caching because it caused unexpected results for some exception inheritance hierarchies. Register handlers explicitly for each exception if you want to avoid traversing the MRO. 2362
> - Fix incorrect JSON encoding of aware, non-UTC datetimes. 2374
> - Template auto reloading will honor debug mode even even if \~Flask.jinja\_env was already accessed. 2373
> - The following old deprecated code was removed. 2385
> - `flask.ext` - import extensions directly by their name instead of through the `flask.ext` namespace. For example, `import flask.ext.sqlalchemy` becomes `import flask_sqlalchemy`.
> - `Flask.init_jinja_globals` - extend Flask.create\_jinja\_environment instead.
> - `Flask.error_handlers` - tracked by Flask.error\_handler\_spec, use Flask.errorhandler to register handlers.
> - `Flask.request_globals_class` - use Flask.app\_ctx\_globals\_class instead.
> - `Flask.static_path` - use Flask.static\_url\_path instead.
> - `Request.module` - use Request.blueprint instead.
> - The Request.json property is no longer deprecated. 1421
> - Support passing a \~werkzeug.test.EnvironBuilder or `dict` to test\_client.open <werkzeug.test.Client.open>. 2412
> - The `flask` command and Flask.run will load environment variables from `.env` and `.flaskenv` files if python-dotenv is installed. 2416
> - When passing a full URL to the test client, the scheme in the URL is used instead of PREFERRED\_URL\_SCHEME. 2430
> ... (truncated)
Commits
- [`291f3c3`](https://github.com/pallets/flask/commit/291f3c338c4d302dbde01ab9153a7817e5a780f5) Bump version number to 1.0
- [`36e68a4`](https://github.com/pallets/flask/commit/36e68a439a073e927b1801704fc7921be58262e1) release 1.0
- [`216151c`](https://github.com/pallets/flask/commit/216151c8a3c02e805fe5d1824708253f7e01e77f) Merge branch '0.12-maintenance'
- [`23047a7`](https://github.com/pallets/flask/commit/23047a71fd7da13be7b545f30807f38f4d9ecb25) Bump version number to 0.12.4.dev
- [`1a9e58e`](https://github.com/pallets/flask/commit/1a9e58e8c97c47c969736d46410f724f4e834f54) Bump version number to 0.12.3
- [`63deee0`](https://github.com/pallets/flask/commit/63deee0a8b0963f1657e2d327773d65632a387d3) release 0.12.3
- [`062745b`](https://github.com/pallets/flask/commit/062745b23f7abaafb144e3d94b6fbdf8ccc456b9) Merge pull request [#2720](https://github-redirect.dependabot.com/pallets/flask/issues/2720) from pallets/setup-link
- [`5c8110d`](https://github.com/pallets/flask/commit/5c8110de25f08bf20e9fda6611403dc5c59ec849) ensure order of project urls
- [`10a77a5`](https://github.com/pallets/flask/commit/10a77a54309876a6aba2e3303d291498c0a9318c) Add project_urls so that PyPI will show GitHub stats.
- [`22992a0`](https://github.com/pallets/flask/commit/22992a0d533f7f68e9fa1845c86dae230d8ff9ba) add donate link
- Additional commits viewable in [compare view](https://github.com/pallets/flask/compare/0.10.1...1.0)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
Bumps flask from 0.10.1 to 1.0. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.* > **Low severity vulnerability that affects flask** > The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. > > Affected versions: < 1.0.0 *Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects flask** > The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. > > Affected versions: < 0.12.3Release notes
*Sourced from [flask's releases](https://github.com/pallets/flask/releases).* > ## 1.0 > The Pallets team is pleased to release Flask 1.0. [Read the announcement on our blog.](https://www.palletsprojects.com/blog/flask-1-0-released/ > > There are over a year's worth of changes in this release. Many features have been improved or changed. [Read the changelog](http://flask.pocoo.org/docs/1.0/changelog/) to understand how your project's code will be affected. > > > JSON Security Fix > ------------------ > > Flask previously decoded incoming JSON bytes using the content type of the request. Although JSON should only be encoded as UTF-8, Flask was more lenient. However, Python includes non-text related encodings that could result in unexpected memory use by a request. > > Flask will now detect the encoding of incoming JSON data as one of the supported UTF encodings, and will not allow arbitrary encodings from the request. > > > Install or Upgrade > ------------------- > > Install from [PyPI](https://pypi.org/project/Flask/) with pip: > > pip install -U Flask > > ## 0.12.4 > This is a repackage of [0.12.3](https://github.com/pallets/flask/releases/0.12.3) to fix an issue with how the package was built. > > > Upgrade > -------- > > Upgrade from [PyPI](https://pypi.org/project/Flask/0.12.4/) with pip. Use a version identifier if you want to stay at 0.12: > > pip install -U 'Flask~=0.12.4' > > ## 0.12.3 > This release includes an important security fix for JSON and a minor backport for CLI support in PyCharm. It is provided for projects that cannot update to Flask 1.0 immediately. See the [1.0 announcement](https://github.com/pallets/flask/blob/flask-1-0-released) and update to it instead if possible. > > > JSON Security Fix > ------------------ > > Flask previously decoded incoming JSON bytes using the content type of the request. Although JSON should only be encoded as UTF-8, Flask was more lenient. However, Python includes non-text related encodings that could result in unexpected memory use by a request. > > Flask will now detect the encoding of incoming JSON data as one of the supported UTF encodings, and will not allow arbitrary encodings from the request. > > > Upgrade > -------- > > Upgrade from [PyPI](https://pypi.org/project/Flask/) with pip. Use a version identifier if you want to stay at 0.12: > > pip install -U 'Flask~=0.12.3' > ... (truncated)Changelog
*Sourced from [flask's changelog](https://github.com/pallets/flask/blob/master/CHANGES.rst).* > Version 1.0 > =========== > > Released 2018-04-26 > > - Python 2.6 and 3.3 are no longer supported. > - Bump minimum dependency versions to the latest stable versions: Werkzeug >= 0.14, Jinja >= 2.10, itsdangerous >= 0.24, Click >= 5.1. 2586 > - Skip app.run <Flask.run> when a Flask application is run from the command line. This avoids some behavior that was confusing to debug. > - Change the default for JSONIFY\_PRETTYPRINT\_REGULAR to `False`. \~json.jsonify returns a compact format by default, and an indented format in debug mode. 2193 > - Flask.\_\_init\_\_ <Flask> accepts the `host_matching` argument and sets it on \~Flask.url\_map. 1559 > - Flask.\_\_init\_\_ <Flask> accepts the `static_host` argument and passes it as the `host` argument when defining the static route. 1559 > - send\_file supports Unicode in `attachment_filename`. 2223 > - Pass `_scheme` argument from url\_for to \~Flask.handle\_url\_build\_error. 2017 > - \~Flask.add\_url\_rule accepts the `provide_automatic_options` argument to disable adding the `OPTIONS` method. 1489 > - \~views.MethodView subclasses inherit method handlers from base classes. 1936 > - Errors caused while opening the session at the beginning of the request are handled by the app's error handlers. 2254 > - Blueprints gained \~Blueprint.json\_encoder and \~Blueprint.json\_decoder attributes to override the app's encoder and decoder. 1898 > - Flask.make\_response raises `TypeError` instead of `ValueError` for bad response types. The error messages have been improved to describe why the type is invalid. 2256 > - Add `routes` CLI command to output routes registered on the application. 2259 > - Show warning when session cookie domain is a bare hostname or an IP address, as these may not behave properly in some browsers, such as Chrome. 2282 > - Allow IP address as exact session cookie domain. 2282 > - `SESSION_COOKIE_DOMAIN` is set if it is detected through `SERVER_NAME`. 2282 > - Auto-detect zero-argument app factory called `create_app` or `make_app` from `FLASK_APP`. 2297 > - Factory functions are not required to take a `script_info` parameter to work with the `flask` command. If they take a single parameter or a parameter named `script_info`, the \~cli.ScriptInfo object will be passed. 2319 > - `FLASK_APP` can be set to an app factory, with arguments if needed, for example `FLASK_APP=myproject.app:create_app('dev')`. 2326 > - `FLASK_APP` can point to local packages that are not installed in editable mode, although `pip install -e` is still preferred. 2414 > - The \~views.View class attribute \~views.View.provide\_automatic\_options is set in \~views.View.as\_view, to be detected by \~Flask.add\_url\_rule. 2316 > - Error handling will try handlers registered for `blueprint, code`, `app, code`, `blueprint, exception`, `app, exception`. 2314 > - `Cookie` is added to the response's `Vary` header if the session is accessed at all during the request (and not deleted). 2288 > - \~Flask.test\_request\_context accepts `subdomain` and `url_scheme` arguments for use when building the base URL. 1621 > - Set APPLICATION\_ROOT to `'/'` by default. This was already the implicit default when it was set to `None`. > - TRAP\_BAD\_REQUEST\_ERRORS is enabled by default in debug mode. `BadRequestKeyError` has a message with the bad key in debug mode instead of the generic bad request message. 2348 > - Allow registering new tags with \~json.tag.TaggedJSONSerializer to support storing other types in the session cookie. 2352 > - Only open the session if the request has not been pushed onto the context stack yet. This allows \~stream\_with\_context generators to access the same session that the containing view uses. 2354 > - Add `json` keyword argument for the test client request methods. This will dump the given object as JSON and set the appropriate content type. 2358 > - Extract JSON handling to a mixin applied to both the Request and Response classes. This adds the \~Response.is\_json and \~Response.get\_json methods to the response to make testing JSON response much easier. 2358 > - Removed error handler caching because it caused unexpected results for some exception inheritance hierarchies. Register handlers explicitly for each exception if you want to avoid traversing the MRO. 2362 > - Fix incorrect JSON encoding of aware, non-UTC datetimes. 2374 > - Template auto reloading will honor debug mode even even if \~Flask.jinja\_env was already accessed. 2373 > - The following old deprecated code was removed. 2385 > - `flask.ext` - import extensions directly by their name instead of through the `flask.ext` namespace. For example, `import flask.ext.sqlalchemy` becomes `import flask_sqlalchemy`. > - `Flask.init_jinja_globals` - extend Flask.create\_jinja\_environment instead. > - `Flask.error_handlers` - tracked by Flask.error\_handler\_spec, use Flask.errorhandler to register handlers. > - `Flask.request_globals_class` - use Flask.app\_ctx\_globals\_class instead. > - `Flask.static_path` - use Flask.static\_url\_path instead. > - `Request.module` - use Request.blueprint instead. > - The Request.json property is no longer deprecated. 1421 > - Support passing a \~werkzeug.test.EnvironBuilder or `dict` to test\_client.open <werkzeug.test.Client.open>. 2412 > - The `flask` command and Flask.run will load environment variables from `.env` and `.flaskenv` files if python-dotenv is installed. 2416 > - When passing a full URL to the test client, the scheme in the URL is used instead of PREFERRED\_URL\_SCHEME. 2430 > ... (truncated)Commits
- [`291f3c3`](https://github.com/pallets/flask/commit/291f3c338c4d302dbde01ab9153a7817e5a780f5) Bump version number to 1.0 - [`36e68a4`](https://github.com/pallets/flask/commit/36e68a439a073e927b1801704fc7921be58262e1) release 1.0 - [`216151c`](https://github.com/pallets/flask/commit/216151c8a3c02e805fe5d1824708253f7e01e77f) Merge branch '0.12-maintenance' - [`23047a7`](https://github.com/pallets/flask/commit/23047a71fd7da13be7b545f30807f38f4d9ecb25) Bump version number to 0.12.4.dev - [`1a9e58e`](https://github.com/pallets/flask/commit/1a9e58e8c97c47c969736d46410f724f4e834f54) Bump version number to 0.12.3 - [`63deee0`](https://github.com/pallets/flask/commit/63deee0a8b0963f1657e2d327773d65632a387d3) release 0.12.3 - [`062745b`](https://github.com/pallets/flask/commit/062745b23f7abaafb144e3d94b6fbdf8ccc456b9) Merge pull request [#2720](https://github-redirect.dependabot.com/pallets/flask/issues/2720) from pallets/setup-link - [`5c8110d`](https://github.com/pallets/flask/commit/5c8110de25f08bf20e9fda6611403dc5c59ec849) ensure order of project urls - [`10a77a5`](https://github.com/pallets/flask/commit/10a77a54309876a6aba2e3303d291498c0a9318c) Add project_urls so that PyPI will show GitHub stats. - [`22992a0`](https://github.com/pallets/flask/commit/22992a0d533f7f68e9fa1845c86dae230d8ff9ba) add donate link - Additional commits viewable in [compare view](https://github.com/pallets/flask/compare/0.10.1...1.0)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.