CHANGES.rst
Unreleased
5730__version__. :pr:5648RequestContext has merged with AppContext. RequestContext is now
a deprecated alias. If an app context is already pushed, it is not reused
when dispatching a request. This greatly simplifies the internal code for tracking
the active context. :issue:5639Flask methods involved in request dispatch now take the current
AppContext as the first parameter, instead of using the proxy objects.
If subclasses were overriding these methods, the old signature is detected,
shows a deprecation warning, and will continue to work during the
deprecation period. :issue:58155928should_ignore_error is deprecated. Handle errors as needed in
teardown handlers instead. :issue:5816template_filter, template_test, and template_global decorators
can be used without parentheses. :issue:5729redirect returns a 303 status code by default instead of 302.
This tells the client to always switch to GET, rather than only
switching POST to GET. This preserves the current behavior of
GET and POST redirects, and is also correct for frontend libraries
such as HTMX. :issue:5895provide_automatic_options=True can be used to enable it for a view when
it's disabled in config. Previously, only disabling worked. :issue:5916Released 2026-02-18
in and len. :ghsa:68rp-wp8r-4726Released 2025-08-19
stream_with_context does not fail inside async views. :issue:5774follow_redirects in the test client, the final state
of session is correct. :issue:5786send_file. :issue:5776Released 2025-05-13
SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28gcli_runner.invoke. :issue:5645flask --help loads the app and plugins first to make sure all commands
are shown. :issue:5673AsyncIterable. This is not accurate for Flask, but makes typing easier
for Quart. :pr:5659Released 2024-11-13
56235624,56335496Flask.open_resource/open_instance_resource and
Blueprint.open_resource take an encoding parameter to use when
opening in text mode. It defaults to utf-8. :issue:5504Request.max_content_length can be customized per-request instead of only
through the MAX_CONTENT_LENGTH config. Added
MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation
about resource limits to the security page. :issue:5625Partitioned cookie attribute (CHIPS), with the
SESSION_COOKIE_PARTITIONED config. :issue:5472-e path takes precedence over default .env and .flaskenv files.
load_dotenv loads default files in addition to a path unless
load_defaults=False is passed. :issue:5628SECRET_KEY_FALLBACKS config, a list of old
secret keys that can still be used for unsigning. Extensions will need to
add support. :issue:5621host_matching=True or subdomain_matching=False
interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts
requests to only that domain. :issue:5553Request.trusted_hosts is checked during routing, and can be set through
the TRUSTED_HOSTS config. :issue:5636Released 2024-04-07
hashlib.sha1 may not be available in FIPS builds. Don't
access it at import time so the developer has time to change the default.
:issue:5448cli attribute in the sansio scaffold, but rather in
the Flask concrete class. :pr:5270Released 2024-02-03
jinja_loader property. :issue:5388--extra-files and --exclude-patterns CLI options.
:issue:5391Released 2024-01-18
path argument to send_file. :issue:5336flask run --key option. :pr:5344json.loads
object_hook. This allows other JSON providers that don't implement that.
:issue:53815383Released 2023-09-30
5223__version__ attribute. Use feature detection, or
importlib.metadata.version("flask"), instead. :issue:523051275264Released 2023-08-21
flit_core instead of setuptools as build backend.5160Released 2023-05-01
Vary: Cookie header when the session is accessed, modified, or refreshed.m2qf-hxjv-5gpqReleased 2023-04-25
from flask import Markup. :issue:5084Released 2023-04-25
Drop support for Python 3.7. :pr:5072
Update minimum requirements to the latest versions: Werkzeug>=2.3.0, Jinja2>3.1.2, itsdangerous>=2.1.2, click>=8.1.3.
Remove previously deprecated code. :pr:4995
push and pop methods of the deprecated _app_ctx_stack and
_request_ctx_stack objects are removed. top still exists to give
extensions more time to update, but it will be removed.FLASK_ENV environment variable, ENV config key, and app.env
property are removed.session_cookie_name, send_file_max_age_default, use_x_sendfile,
propagate_exceptions, and templates_auto_reload properties on app
are removed.JSON_AS_ASCII, JSON_SORT_KEYS, JSONIFY_MIMETYPE, and
JSONIFY_PRETTYPRINT_REGULAR config keys are removed.app.before_first_request and bp.before_app_first_request decorators
are removed.json_encoder and json_decoder attributes on app and blueprint, and the
corresponding json.JSONEncoder and JSONDecoder classes, are removed.json.htmlsafe_dumps and htmlsafe_dump functions are removed.4997Importing escape and Markup from flask is deprecated. Import them
directly from markupsafe instead. :pr:4996
The app.got_first_request property is deprecated. :pr:4997
The locked_cached_property decorator is deprecated. Use a lock inside the
decorated function if locking is needed. :issue:4993
Signals are always available. blinker>=1.6.2 is a required dependency. The
signals_available attribute is deprecated. :issue:5056
Signals support async subscriber functions. :pr:5049
Remove uses of locks that could cause requests to block each other very briefly.
:issue:4993
Use modern packaging metadata with pyproject.toml instead of setup.cfg.
:pr:4947
Ensure subdomains are applied with nested blueprints. :issue:4834
config.from_file can use text=False to indicate that the parser wants a
binary file instead. :issue:4989
If a blueprint is created with an empty name it raises a ValueError.
:issue:5010
SESSION_COOKIE_DOMAIN does not fall back to SERVER_NAME. The default is not
to set the domain, which modern browsers interpret as an exact match rather than
a subdomain match. Warnings about localhost and IP addresses are also removed.
:issue:5051
The routes command shows each rule's subdomain or host when domain
matching is in use. :issue:5004
Use postponed evaluation of annotations. :pr:5071
Released 2023-05-02
Vary: Cookie header when the session is accessed, modified, or refreshed.Released 2023-04-25
Released 2023-02-15
.svg template files. :issue:4831template_folder to accept pathlib.Path. :issue:4892--debug option to the flask run command. :issue:4777Released 2022-08-08
4754app.env to be "production". This
attribute remains deprecated. :issue:4740Released 2022-08-03
json_encoder or json_decoder raises a
deprecation warning. :issue:4732Released 2022-08-01
Remove previously deprecated code. :pr:4667
send_file parameters have been removed.
download_name replaces attachment_filename, max_age
replaces cache_timeout, and etag replaces add_etags.
Additionally, path replaces filename in
send_from_directory.RequestContext.g property returning AppContext.g is
removed.Update Werkzeug dependency to >= 2.2.
The app and request contexts are managed using Python context vars
directly rather than Werkzeug's LocalStack. This should result
in better performance and memory use. :pr:4682
_app_ctx_stack.top
and _request_ctx_stack.top are deprecated. Store data on
g instead using a unique prefix, like
g._extension_name_attr.The FLASK_ENV environment variable and app.env attribute are
deprecated, removing the distinction between development and debug
mode. Debug mode should be controlled directly using the --debug
option or app.run(debug=True). :issue:4714
Some attributes that proxied config keys on app are deprecated:
session_cookie_name, send_file_max_age_default,
use_x_sendfile, propagate_exceptions, and
templates_auto_reload. Use the relevant config keys instead.
:issue:4716
Add new customization points to the Flask app object for many
previously global behaviors.
flask.url_for will call app.url_for. :issue:4568flask.abort will call app.aborter.
Flask.aborter_class and Flask.make_aborter can be used
to customize this aborter. :issue:4567flask.redirect will call app.redirect. :issue:4569flask.json is an instance of JSONProvider. A different
provider can be set to use a different JSON library.
flask.jsonify will call app.json.response, other
functions in flask.json will call corresponding functions in
app.json. :pr:4692JSON configuration is moved to attributes on the default
app.json provider. JSON_AS_ASCII, JSON_SORT_KEYS,
JSONIFY_MIMETYPE, and JSONIFY_PRETTYPRINT_REGULAR are
deprecated. :pr:4692
Setting custom json_encoder and json_decoder classes on the
app or a blueprint, and the corresponding json.JSONEncoder and
JSONDecoder classes, are deprecated. JSON behavior can now be
overridden using the app.json provider interface. :pr:4692
json.htmlsafe_dumps and json.htmlsafe_dump are deprecated,
the function is built-in to Jinja now. :pr:4692
Refactor register_error_handler to consolidate error checking.
Rewrite some error messages to be more consistent. :issue:4559
Use Blueprint decorators and functions intended for setup after
registering the blueprint will show a warning. In the next version,
this will become an error just like the application setup methods.
:issue:4571
before_first_request is deprecated. Run setup code when creating
the application instead. :issue:4605
Added the View.init_every_request class attribute. If a view
subclass sets this to False, the view will not create a new
instance on every request. :issue:2520.
A flask.cli.FlaskGroup Click group can be nested as a
sub-command in a custom CLI. :issue:3263
Add --app and --debug options to the flask CLI, instead
of requiring that they are set through environment variables.
:issue:2836
Add --env-file option to the flask CLI. This allows
specifying a dotenv file to load in addition to .env and
.flaskenv. :issue:3108
It is no longer required to decorate custom CLI commands on
app.cli or blueprint.cli with @with_appcontext, an app
context will already be active at that point. :issue:2410
SessionInterface.get_expiration_time uses a timezone-aware
value. :pr:4645
View functions can return generators directly instead of wrapping
them in a Response. :pr:4629
Add stream_template and stream_template_string functions to
render a template as a stream of pieces. :pr:4629
A new implementation of context preservation during debugging and
testing. :pr:4666
request, g, and other context-locals point to the
correct data when running code in the interactive debugger
console. :issue:2836stream_with_context preserves context separately from a
with client block. It will be cleaned up when
response.get_data() or response.close() is called.Allow returning a list from a view function, to convert it to a
JSON response like a dict is. :issue:4672
When type checking, allow TypedDict to be returned from view
functions. :pr:4695
Remove the --eager-loading/--lazy-loading options from the
flask run command. The app is always eager loaded the first
time, then lazily loaded in the reloader. The reloader always prints
errors immediately but continues serving. Remove the internal
DispatchingApp middleware used by the previous implementation.
:issue:4715
Released 2022-07-13
4606after_request functions. :issue:4600instance_path for namespace packages uses the path closest to
the imported submodule. :issue:4610render_template and
render_template_string are used outside an application context.
:pr:4693Released 2022-04-28
json.loads, it accepts str or bytes.
:issue:4519--cert and --key options on flask run can be given
in either order. :issue:4459Released on 2022-03-30
4502Released 2022-03-28
Drop support for Python 3.6. :pr:4335
Update Click dependency to >= 8.0. :pr:4008
Remove previously deprecated code. :pr:4337
script_info to app factory functions.config.from_json is replaced by
config.from_file(name, load=json.load).json functions no longer take an encoding parameter.safe_join is removed, use werkzeug.utils.safe_join
instead.total_seconds is removed, use timedelta.total_seconds
instead.name= when registering to specify a unique name.as_tuple parameter is removed. Use
response.request.environ instead. :pr:4417Some parameters in send_file and send_from_directory were
renamed in 2.0. The deprecation period for the old names is extended
to 2.2. Be sure to test with deprecation warnings visible.
attachment_filename is renamed to download_name.cache_timeout is renamed to max_age.add_etags is renamed to etag.filename is renamed to path.The RequestContext.g property is deprecated. Use g directly
or AppContext.g instead. :issue:3898
copy_current_request_context can decorate async functions.
:pr:4303
The CLI uses importlib.metadata instead of pkg_resources to
load command entry points. :issue:4419
Overriding FlaskClient.open will not cause an error on redirect.
:issue:3396
Add an --exclude-patterns option to the flask run CLI
command to specify patterns that will be ignored by the reloader.
:issue:4188
When using lazy loading (the default with the debugger), the Click
context from the flask run command remains available in the
loader thread. :issue:4460
Deleting the session cookie uses the httponly flag.
:issue:4485
Relax typing for errorhandler to allow the user to use more
precise types and decorate the same function multiple times.
:issue:4095, 4295, 4297
Fix typing for __exit__ methods for better compatibility with
ExitStack. :issue:4474
From Werkzeug, for redirect responses the Location header URL
will remain relative, and exclude the scheme and domain, by default.
:pr:4496
Add Config.from_prefixed_env() to load config values from
environment variables that start with FLASK_ or another prefix.
This parses values as JSON by default, and allows setting keys in
nested dicts. :pr:4479
Released 2022-02-14
as_tuple parameter is deprecated and will be
removed in Werkzeug 2.1. It is now also deprecated in Flask, to be
removed in Flask 2.1, while remaining compatible with both in
2.0.x. Use response.request.environ instead. :pr:4341errorhandler decorator. :issue:4295ImportError
tracebacks when importing the application. :issue:4307app.json_encoder and json_decoder are only passed to
dumps and loads if they have custom behavior. This improves
performance, mainly on PyPy. :issue:4349after_this_request is used outside a
request context. :issue:4333Released 2021-10-04
teardown_* methods. :issue:4093before_request and before_app_request
decorators. :issue:410440984112app.errorhandler decorator. :issue:40954124static_folder to accept pathlib.Path.
:issue:4150jsonify handles decimal.Decimal by encoding to str.
:issue:41574096**kwargs in a create_app function.
:issue:4170before_request and other callbacks that trigger
before the view returns. They are called from the app down to the
closest nested blueprint. :issue:4229Released 2021-05-21
filename parameter in send_from_directory. The
filename parameter has been renamed to path, the old name
is deprecated. :pr:40194024g and inform mypy that it is a namespace
object that has arbitrary attributes. :issue:40204040send_file, send_from_directory, and
get_send_file_max_age. :issue:4044, :pr:4026. has
special meaning, it is used to separate (nested) blueprint names and
the endpoint name. :issue:4041url_prefix value. :issue:40374053Config.from_json, which was accidentally
removed early. :issue:4078Callable in their type
signatures, focusing on decorator factories. :issue:40604069register_blueprint takes a name option to change the
(pre-dotted) name the blueprint is registered with. This allows the
same blueprint to be registered multiple times with unique names for
url_for. Registering the same blueprint with the same name
multiple times is deprecated. :issue:1091stream_with_context. :issue:4052Released 2021-05-11
app.json_encoder and json_decoder. :issue:3555encoding option to JSON functions is deprecated. :pr:3562script_info to app factory functions is deprecated. This
was not portable outside the flask command. Use
click.get_current_context().obj if it's needed. :issue:35522741SessionInterface.get_cookie_name to allow setting the
session cookie name dynamically. :pr:3369Config.from_file to load config using arbitrary file
loaders, such as toml.load or json.load.
Config.from_json is deprecated in favor of this. :pr:3398flask run command will only defer errors on reload. Errors
present during the initial call will cause the server to exit with
the traceback immediately. :issue:3431send_file raises a ValueError when passed an io object
in text mode. Previously, it would respond with 200 OK and an empty
file. :issue:33583492FLASK_APP, keyword
argument can be passed. :issue:3553.env or .flaskenv file, the current working
directory is no longer changed to the location of the file.
:pr:3560(response, headers) tuple from a view, the
headers replace rather than extend existing headers on the response.
For example, this allows setting the Content-Type for
jsonify(). Use response.headers.extend() if extending is
desired. :issue:3628Scaffold class provides a common API for the Flask and
Blueprint classes. Blueprint information is stored in
attributes just like Flask, rather than opaque lambda functions.
This is intended to improve consistency and maintainability.
:issue:3215samesite and secure options when removing the
session cookie. :pr:3726pathlib.Path to static_folder. :pr:3579send_file and send_from_directory are wrappers around the
implementations in werkzeug.utils. :pr:3828send_file parameters have been renamed, the old names are
deprecated. attachment_filename is renamed to download_name.
cache_timeout is renamed to max_age. add_etags is
renamed to etag. :pr:3828, 3883send_file passes download_name even if
as_attachment=False by using Content-Disposition: inline.
:pr:3828send_file sets conditional=True and max_age=None by
default. Cache-Control is set to no-cache if max_age is
not set, otherwise public. This tells browsers to validate
conditional requests instead of using a timed cache. :pr:3828helpers.safe_join is deprecated. Use
werkzeug.utils.safe_join instead. :pr:3828request.endpoint. :issue:3776|tojson filter. :issue:3881@app.post("/login") is a shortcut for
@app.route("/login", methods=["POST"]). :pr:39073412593, 1548, :pr:3923.env and
.flaskenv files to allow to use non-ASCII characters. :issue:3931flask shell sets up tab and history completion like the default
python shell if readline is installed. :issue:3941helpers.total_seconds() is deprecated. Use
timedelta.total_seconds() instead. :pr:39623973.Released 2021-05-13
static_folder to use _compat.fspath instead of
os.fspath to continue supporting Python < 3.6 :issue:4050Released 2021-05-13
4043pathlib.Path for static_folder.
:pr:3579Released 2020-04-03
flask command with an
external debugger on Windows. :issue:3297Flask
static_folder argument ends with a slash. :issue:3452Released 2019-07-08
flask.json_available flag was added back for compatibility
with some extensions. It will raise a deprecation warning when used,
and will be removed in version 2.0.0. :issue:3288Released 2019-07-04
Bump minimum Werkzeug version to >= 0.15.
Drop support for Python 3.4.
Error handlers for InternalServerError or 500 will always be
passed an instance of InternalServerError. If they are invoked
due to an unhandled exception, that original exception is now
available as e.original_exception rather than being passed
directly to the handler. The same is true if the handler is for the
base HTTPException. This makes error handler behavior more
consistent. :pr:3266
Flask.finalize_request is called for all unhandled
exceptions even if there is no 500 error handler.Flask.logger takes the same name as Flask.name (the value
passed as Flask(import_name). This reverts 1.0's behavior of
always logging to "flask.app", in order to support multiple apps
in the same process. A warning will be shown if old configuration is
detected that needs to be moved. :issue:2866
RequestContext.copy includes the current session object in the
request context copy. This prevents session pointing to an
out-of-date object. :issue:2935
Using built-in RequestContext, unprintable Unicode characters in
Host header will result in a HTTP 400 response and not HTTP 500 as
previously. :pr:2994
send_file supports PathLike objects as described in
:pep:519, to support pathlib in Python 3. :pr:3059
send_file supports BytesIO partial content.
:issue:2957
open_resource accepts the "rt" file mode. This still does the
same thing as "r". :issue:3163
The MethodView.methods attribute set in a base class is used by
subclasses. :issue:3138
Flask.jinja_options is a dict instead of an
ImmutableDict to allow easier configuration. Changes must still
be made before creating the environment. :pr:3190
Flask's JSONMixin for the request and response wrappers was
moved into Werkzeug. Use Werkzeug's version with Flask-specific
support. This bumps the Werkzeug dependency to >= 0.15.
:issue:3125
The flask command entry point is simplified to take advantage
of Werkzeug 0.15's better reloader support. This bumps the Werkzeug
dependency to >= 0.15. :issue:3022
Support static_url_path that ends with a forward slash.
:issue:3134
Support empty static_folder without requiring setting an empty
static_url_path as well. :pr:3124
jsonify supports dataclass objects. :pr:3195
Allow customizing the Flask.url_map_class used for routing.
:pr:3069
The development server port can be set to 0, which tells the OS to
pick an available port. :issue:2926
The return value from cli.load_dotenv is more consistent with
the documentation. It will return False if python-dotenv is not
installed, or if the given path isn't a file. :issue:2937
Signaling support has a stub for the connect_via method when
the Blinker library is not installed. :pr:3208
Add an --extra-files option to the flask run CLI command to
specify extra files that will trigger the reloader on change.
:issue:2897
Allow returning a dictionary from a view function. Similar to how
returning a string will produce a text/html response, returning
a dict will call jsonify to produce a application/json
response. :pr:3111
Blueprints have a cli Click group like app.cli. CLI commands
registered with a blueprint will be available as a group under the
flask command. :issue:1357.
When using the test client as a context manager (with client:),
all preserved request contexts are popped when the block exits,
ensuring nested contexts are cleaned up correctly. :pr:3157
Show a better error message when the view return type is not
supported. :issue:3214
flask.testing.make_test_environ_builder() has been deprecated in
favour of a new class flask.testing.EnvironBuilder. :pr:3232
The flask run command no longer fails if Python is not built
with SSL support. Using the --cert option will show an
appropriate error message. :issue:3211
URL matching now occurs after the request context is pushed, rather
than when it's created. This allows custom URL converters to access
the app and request contexts, such as to query a database for an id.
:issue:3088
Released 2019-07-04
BadRequestKeyError is no longer cleared
outside debug mode, so error handlers can still access it. This
requires upgrading to Werkzeug 0.15.5. :issue:3249send_file url quotes the ":" and "/" characters for more
compatible UTF-8 filename support in some browsers. :issue:3074451 import loaders and pytest 5.x. :issue:32753285Released 2019-05-17
send_file encodes filenames as ASCII instead of Latin-1
(ISO-8859-1). This fixes compatibility with Gunicorn, which is
stricter about header encodings than :pep:3333. :issue:2766FlaskGroup to set the debug flag without
it always being overwritten based on environment variables.
:pr:2765flask --version outputs Werkzeug's version and simplifies the
Python version. :pr:2825send_file handles an attachment_filename that is a native
Python 2 string (bytes) with UTF-8 coded bytes. :issue:2933HTTPException will not
handle RoutingException, which is used internally during
routing. This fixes the unexpected behavior that had been introduced
in 1.0. :pr:2986json argument to app.test_client does not
push/pop an extra app context. :issue:2900Released 2018-05-02
2748flask routes command when there are no routes.
:issue:2751Released 2018-04-29
__name__) as view functions.
:pr:27302736url_prefix and a route URL
are merged. This fixes some backwards compatibility issues with the
change in 1.0. :issue:2731, :issue:2742BadRequestKeyError errors in debug mode, not all
BadRequest errors. This allows abort(400) to continue
working as expected. :issue:2735FLASK_SKIP_DOTENV environment variable can be set to 1
to skip automatically loading dotenv files. :issue:2722Released 2018-04-26
Python 2.6 and 3.3 are no longer supported.
Bump minimum dependency versions to the latest stable versions:
Werkzeug >= 0.14, Jinja >= 2.10, itsdangerous >= 0.24, Click >= 5.1.
:issue:2586
Skip app.run when a Flask application is run from the command
line. This avoids some behavior that was confusing to debug.
Change the default for JSONIFY_PRETTYPRINT_REGULAR to
False. ~json.jsonify returns a compact format by default,
and an indented format in debug mode. :pr:2193
Flask.__init__ accepts the host_matching argument and sets
it on Flask.url_map. :issue:1559
Flask.__init__ accepts the static_host argument and passes
it as the host argument when defining the static route.
:issue:1559
send_file supports Unicode in attachment_filename.
:pr:2223
Pass _scheme argument from url_for to
Flask.handle_url_build_error. :pr:2017
Flask.add_url_rule accepts the provide_automatic_options
argument to disable adding the OPTIONS method. :pr:1489
MethodView subclasses inherit method handlers from base classes.
:pr:1936
Errors caused while opening the session at the beginning of the
request are handled by the app's error handlers. :pr:2254
Blueprints gained Blueprint.json_encoder and
Blueprint.json_decoder attributes to override the app's
encoder and decoder. :pr:1898
Flask.make_response raises TypeError instead of
ValueError for bad response types. The error messages have been
improved to describe why the type is invalid. :pr:2256
Add routes CLI command to output routes registered on the
application. :pr:2259
Show warning when session cookie domain is a bare hostname or an IP
address, as these may not behave properly in some browsers, such as
Chrome. :pr:2282
Allow IP address as exact session cookie domain. :pr:2282
SESSION_COOKIE_DOMAIN is set if it is detected through
SERVER_NAME. :pr:2282
Auto-detect zero-argument app factory called create_app or
make_app from FLASK_APP. :pr:2297
Factory functions are not required to take a script_info
parameter to work with the flask command. If they take a single
parameter or a parameter named script_info, the ScriptInfo
object will be passed. :pr:2319
FLASK_APP can be set to an app factory, with arguments if
needed, for example FLASK_APP=myproject.app:create_app('dev').
:pr:2326
FLASK_APP can point to local packages that are not installed in
editable mode, although pip install -e is still preferred.
:pr:2414
The View class attribute
View.provide_automatic_options is set in View.as_view, to be
detected by Flask.add_url_rule. :pr:2316
Error handling will try handlers registered for blueprint, code,
app, code, blueprint, exception, app, exception.
:pr:2314
Cookie is added to the response's Vary header if the session
is accessed at all during the request (and not deleted). :pr:2288
Flask.test_request_context accepts subdomain and
url_scheme arguments for use when building the base URL.
:pr:1621
Set APPLICATION_ROOT to '/' by default. This was already the
implicit default when it was set to None.
TRAP_BAD_REQUEST_ERRORS is enabled by default in debug mode.
BadRequestKeyError has a message with the bad key in debug mode
instead of the generic bad request message. :pr:2348
Allow registering new tags with TaggedJSONSerializer to support
storing other types in the session cookie. :pr:2352
Only open the session if the request has not been pushed onto the
context stack yet. This allows stream_with_context generators to
access the same session that the containing view uses. :pr:2354
Add json keyword argument for the test client request methods.
This will dump the given object as JSON and set the appropriate
content type. :pr:2358
Extract JSON handling to a mixin applied to both the Request and
Response classes. This adds the Response.is_json and
Response.get_json methods to the response to make testing JSON
response much easier. :pr:2358
Removed error handler caching because it caused unexpected results
for some exception inheritance hierarchies. Register handlers
explicitly for each exception if you want to avoid traversing the
MRO. :pr:2362
Fix incorrect JSON encoding of aware, non-UTC datetimes. :pr:2374
Template auto reloading will honor debug mode even if
Flask.jinja_env was already accessed. :pr:2373
The following old deprecated code was removed. :issue:2385
flask.ext - import extensions directly by their name instead
of through the flask.ext namespace. For example,
import flask.ext.sqlalchemy becomes
import flask_sqlalchemy.Flask.init_jinja_globals - extend
Flask.create_jinja_environment instead.Flask.error_handlers - tracked by
Flask.error_handler_spec, use Flask.errorhandler
to register handlers.Flask.request_globals_class - use
Flask.app_ctx_globals_class instead.Flask.static_path - use Flask.static_url_path instead.Request.module - use Request.blueprint instead.The Request.json property is no longer deprecated. :issue:1421
Support passing a EnvironBuilder or dict to
test_client.open. :pr:2412
The flask command and Flask.run will load environment
variables from .env and .flaskenv files if python-dotenv is
installed. :pr:2416
When passing a full URL to the test client, the scheme in the URL is
used instead of PREFERRED_URL_SCHEME. :pr:2430
Flask.logger has been simplified. LOGGER_NAME and
LOGGER_HANDLER_POLICY config was removed. The logger is always
named flask.app. The level is only set on first access, it
doesn't check Flask.debug each time. Only one format is used,
not different ones depending on Flask.debug. No handlers are
removed, and a handler is only added if no handlers are already
configured. :pr:2436
Blueprint view function names may not contain dots. :pr:2450
Fix a ValueError caused by invalid Range requests in some
cases. :issue:2526
The development server uses threads by default. :pr:2529
Loading config files with silent=True will ignore ENOTDIR
errors. :pr:2581
Pass --cert and --key options to flask run to run the
development server over HTTPS. :pr:2606
Added SESSION_COOKIE_SAMESITE to control the SameSite
attribute on the session cookie. :pr:2607
Added Flask.test_cli_runner to create a Click runner that can
invoke Flask CLI commands for testing. :pr:2636
Subdomain matching is disabled by default and setting
SERVER_NAME does not implicitly enable it. It can be enabled by
passing subdomain_matching=True to the Flask constructor.
:pr:2635
A single trailing slash is stripped from the blueprint
url_prefix when it is registered with the app. :pr:2629
Request.get_json doesn't cache the result if parsing fails when
silent is true. :issue:2651
Request.get_json no longer accepts arbitrary encodings. Incoming
JSON should be encoded using UTF-8 per :rfc:8259, but Flask will
autodetect UTF-8, -16, or -32. :pr:2691
Added MAX_COOKIE_SIZE and Response.max_cookie_size to
control when Werkzeug warns about large cookies that browsers may
ignore. :pr:2693
Updated documentation theme to make docs look better in small
windows. :pr:2709
Rewrote the tutorial docs and example project to take a more
structured approach to help new users avoid common pitfalls.
:pr:2676
Released 2020-02-10
3497Released 2018-04-29
2728Released 2018-04-26
Request.get_json no longer accepts arbitrary encodings.
Incoming JSON should be encoded using UTF-8 per :rfc:8259, but
Flask will autodetect UTF-8, -16, or -32. :issue:2692python -m flask.
:issue:2666ValueError caused by invalid Range requests in some
cases.Released 2017-05-16
safe_join on Windows.Released 2017-03-31
flask run from showing a NoAppException when an
ImportError occurs within the imported application module.app.config.from_pyfile for Python 3.
:issue:2118SERVER_NAME config if it is present as default values
for app.run. :issue:2109, :pr:2152ctx.auto_pop with the exception object instead of None,
in the event that a BaseException such as KeyboardInterrupt
is raised in a request handler.Released 2016-12-21, codename Punsch
--version.send_file has been removed. :issue:104, :pr1849send_file now fails loudly and doesn't fall
back to application/octet-stream. :pr:1988flask.safe_join able to join multiple paths like
os.path.join :pr:17302006send_file.app.test_client includes preset default environment, which can
now be directly set, instead of per client.get.1814Released 2016-06-07
FLASK_APP=foobar/__init__.py from
working. :pr:1872Released 2016-05-29, codename Absinthe
jsonify. This
introduces a security risk in ancient browsers.**kwargs to Flask.test_client to support passing
additional keyword arguments to the constructor of
Flask.test_client_class.SESSION_REFRESH_EACH_REQUEST config key that controls the
set-cookie behavior. If set to True a permanent session will be
refreshed each request and get their lifetime extended, if set to
False it will only be modified if the session actually modifies.
Non permanent sessions are not affected by this and will always
expire if the browser window closes.(response, headers) from a view function.Config.from_json.Flask.config_class.Config.get_namespace.TEMPLATES_AUTO_RELOAD
config key.flask and the flask.cli module to start the
local debug server through the click CLI system. This is recommended
over the old flask.run() method as it works faster and more
reliable due to a different design and also replaces
Flask-Script.werkzeug.exceptions). This makes it possible for
an extension author to create exceptions that will by default result
in the HTTP error of their choosing, but may be caught with a custom
error handler if desired.Config.from_mapping.LOGGER_HANDLER_POLICY configuration key.EXPLAIN_TEMPLATE_LOADING config flag which when
enabled will instruct Flask to explain how it locates templates.
This should help users debug when the wrong templates are loaded.request.json in favour of request.get_json().JSONIFY_PRETTYPRINT_REGULAR=False by removing unnecessary white
space included by default after separators.1262OPTIONS method is now correctly
disabled if the user registered an overriding rule with the
lowercase-version options. :issue:1288flask.json.jsonify now supports the datetime.date type.
:pr:132613931422flask.g now has pop() and setdefault methods.flask.templating.render_template_string
by default. :pr:1515flask.ext is now deprecated. :pr:1484send_from_directory now raises BadRequest if the filename is
invalid on the server OS. :pr:1763JSONIFY_MIMETYPE configuration variable. :pr:1728test_appcontext_signals() test case.AttributeError in helpers.find_package with a
useful message explaining why it is raised when a :pep:302 import
hook is used without an is_package() method.@before_first_request into a decorator as intended.send_from_directory not expanding to the application root
path correctly.app.url_build_error_handlers reraises the BuildError.Released 2013-06-14
|tojson was not quoting single quotes which
made the filter not work properly in HTML attributes. Now it's
possible to use that filter in single quoted attributes. This should
make using that filter with angular.js easier.Released 2013-06-13, codename Limoncello
template_test methods in addition to the already existing
template_filter method family.template_global methods in addition to the already
existing template_filter method family.tojson filter now does not escape script blocks in HTML5
parsers.tojson used in templates is now safe by default. This was
allowed due to the different escaping behavior.flask.session module alias. Use
flask.sessions instead to get the session module. This is not to
be confused with flask.session the session proxy.request, session and g
objects will not be available and blueprint's context processors are
not called.flask.json.dumps to return bytes by default.flask.g is now stored on the app context instead of the request
context.flask.g now gained a get() method for not erroring out on
non existing items.flask.g now can be used with the in operator to see what's
defined and it now is iterable and will yield all attributes stored.flask.Flask.request_globals_class got renamed to
flask.Flask.app_ctx_globals_class which is a better name to what
it does since 0.10.request, session and g are now also added as proxies to
the template context which makes them available in imported
templates. One has to be very careful with those though because
usage outside of macros might cause caching.message_flashed signal that simplifies flashing testing.JSONIFY_PRETTYPRINT_REGULAR configuration variable.appcontext_pushed and appcontext_popped signals.SERVER_NAME into account
when picking the default port to run on.flask.request.get_json() as a replacement for the old
flask.request.json property.Released 2012-07-01, codename Campari
Request.on_json_loading_failed now returns a JSON formatted
response by default.url_for function now can generate anchors to the generated
links.url_for function now can also explicitly generate URL rules
specific to a given HTTP method.werkzeug.request will be None after the response was
returned to the WSGI server but has the advantage that the garbage
collector is not needed on CPython to tear down the request unless
the user created circular dependencies themselves.Flask class will avoid importing the provided import name if
it can (the required first parameter), to benefit tools which build
Flask instances programmatically. The Flask class will fall back to
using import on systems with custom module hooks, e.g. Google App
Engine, or when the import name is inside a zip archive (usually an
egg) prior to Python 2.7.Blueprint.app_template_filter.Flask.add_template_filter and
Blueprint.add_app_template_filter.get_flashed_messages function now allows rendering flashed
message categories in separate blocks, through a category_filter
argument.Flask.run method now accepts None for host and
port arguments, using default values when None. This allows
for calling run using configuration values, e.g.
app.run(app.config.get('MYHOST'), app.config.get('MYPORT')),
with proper behavior whether or not a config file is provided.render_template method now accepts a either an iterable of
template names or a single template name. Previously, it only
accepted a single template name. On an iterable, the first template
found is rendered.Flask.app_context which works very similar to the request
context but only provides access to the current application. This
also adds support for URL generation without an active request
context.Response. This allows for returning
jsonify(error="error msg"), 400 from a view function.Flask and Blueprint now provide a get_send_file_max_age
hook for subclasses to override behavior of serving static files
from Flask when using Flask.send_static_file (used for the
default static file handler) and helpers.send_file. This hook is
provided a filename, which for example allows changing cache
controls by file extension. The default max-age for send_file
and static files can be configured through a new
SEND_FILE_MAX_AGE_DEFAULT configuration variable, which is used
in the default get_send_file_max_age implementation.Flask.request_globals_class to allow a specific class to
be used on creation of the g instance of each request.required_methods attribute to view functions to force-add
methods on registration.flask.after_this_request.flask.stream_with_context and the ability to push contexts
multiple times without producing unexpected behavior.Released 2012-07-01
flask.session module to not
work properly on Python 2.5. It should not be used but did cause
some problems for package managers.Released 2011-09-29, codename Rakija
Flask.before_first_request.APPLICATION_ROOT configuration variable.TestClient.session_transaction to easily modify
sessions from the test environment.APPLICATION_ROOT
configuration variable as well as SERVER_NAME are now properly
used by the test client as defaults.View.decorators to support simpler decorating of pluggable
(class-based) views.get method if no handler was implemented.flask.ext package to import extensions
from.list_templates method not
returning the correct names when blueprints or modules were
involved.Released 2011-07-06
Released 2011-06-29
Released 2011-06-28, codename Grappa
Flask.make_default_options_response which can be used by
subclasses to alter the default behavior for OPTIONS responses.RuntimeError instead of an
AttributeError.send_file because it was unreliable. Pass
filenames instead or attach your own etags and provide a proper
mimetype by hand.PROPAGATE_EXCEPTIONS configuration variable that can be
used to flip the setting of exception propagation which previously
was linked to DEBUG alone and is now linked to either DEBUG
or TESTING.add_url_rule function and can now also accept regular werkzeug
rules added to the url map.endpoint method to the flask application object which
allows one to register a callback to an arbitrary endpoint with a
decorator.create_jinja_loader to override the loader creation
process.config.from_pyfile.teardown_request decorator, for functions that should run
at the end of a request regardless of whether an exception occurred.
Also the behavior for after_request was changed. It's now no
longer executed when an exception is raised.has_request_context.init_jinja_globals. Override the
Flask.create_jinja_environment method instead to achieve the
same functionality.safe_join.get_flashed_messages if there are no
messages in the session.before_request handlers are now able to abort requests with
errors.Released 2010-12-31
OPTIONS response was not
exposing all valid methods in the Allow header.Released 2010-07-27, codename Whisky
Flask.config is now available in the templates as config.MAX_CONTENT_LENGTH configuration value.Module.add_url_rule method is now optional
to be consistent with the function of the same name on the
application object.make_response function that simplifies creating response
object instances in views.blinker installed.Flask.create_url_adapter method.Released 2010-07-15
Released 2010-07-06
Released 2010-07-06, codename Calvados
SERVER_NAME config key. This key is now also used to set the
session cookie cross-subdomain wide..html, .htm, .xml and .xhtml. Inside
templates this behavior can be changed with the autoescape tag.send_file now emits etags and has the ability to do conditional
responses builtin.create_jinja_loader which is no longer used
in 0.5 due to the improved module support.Released 2010-06-18, codename Rakia
Flask.after_request handlers are now also invoked if the request
dies with an exception and an error handling page kicks in.TESTING switch that can activate unittesting helpers.DEBUG mode now if debug is enabled.Released 2010-05-28
Config.from_envvar.Released 2010-05-28, codename Schnaps
logging.Handler and will log
request handling exceptions to that logger when not in debug mode.
This makes it possible to receive mails on server errors for
example.Released 2010-05-12, codename J?germeister
get_template_attribute helper function.Flask.add_url_rule can now also register a view function.send_file.Released 2010-04-16