Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update werkzeug to 0.13 #15

Closed
wants to merge 1 commit into from
Closed

Update werkzeug to 0.13 #15

wants to merge 1 commit into from

Conversation

pyup-bot
Copy link
Collaborator

@pyup-bot pyup-bot commented Dec 7, 2017

There's a new version of werkzeug available.
You are currently using 0.8.3. I have updated it to 0.13

These links might come in handy: PyPI | Changelog | Homepage

Changelog

0.13

Released on December 7th 2017

  • Deprecate support for Python 2.6 and 3.3. CI tests will not run
    for these versions, and support will be dropped completely in the next
    version. (pallets/meta24_)
  • Raise TypeError when port is not an integer. (1088_)
  • Fully deprecate werkzeug.script. Use Click_ instead. (1090_)
  • response.age is parsed as a timedelta. Previously, it was
    incorrectly treated as a datetime. The header value is an integer
    number of seconds, not a date string. (414_)
  • Fix a bug in TypeConversionDict where errors are not propagated
    when using the converter. (1102_)
  • Authorization.qop is a string instead of a set, to comply with
    RFC 2617. (984_)
  • An exception is raised when an encoded cookie is larger than, by
    default, 4093 bytes. Browsers may silently ignore cookies larger than
    this. BaseResponse has a new attribute max_cookie_size and
    dump_cookie has a new argument max_size to configure this.
    (780, 1109)
  • Fix a TypeError in werkzeug.contrib.lint.GuardedIterator.close.
    (1116_)
  • BaseResponse.calculate_content_length now correctly works for
    Unicode responses on Python 3. It first encodes using
    iter_encoded. (705_)
  • Secure cookie contrib works with string secret key on Python 3.
    (1205_)
  • Shared data middleware accepts a list instead of a dict of static
    locations to preserve lookup order. (1197_)
  • HTTP header values without encoding can contain single quotes.
    (1208_)
  • The built-in dev server supports receiving requests with chunked
    transfer encoding. (1198_)

.. _Click: https://www.palletsprojects.com/p/click/
.. _pallets/meta24: https://github.com/pallets/meta/issues/24
.. _414: pallets/werkzeug#414
.. _705: pallets/werkzeug#705
.. _780: pallets/werkzeug#780
.. _984: pallets/werkzeug#984
.. _1088: pallets/werkzeug#1088
.. _1090: pallets/werkzeug#1090
.. _1102: pallets/werkzeug#1102
.. _1109: pallets/werkzeug#1109
.. _1116: pallets/werkzeug#1116
.. _1197: pallets/werkzeug#1197
.. _1198: pallets/werkzeug#1198
.. _1205: pallets/werkzeug#1205
.. _1208: pallets/werkzeug#1208

0.12.2

Released on May 16 2017

  • Fix regression: Pull request 892 prevented Werkzeug from correctly
    logging the IP of a remote client behind a reverse proxy, even when using
    ProxyFix.
  • Fix a bug in safe_join on Windows.

0.12.1

Released on March 15th 2017

  • Fix crash of reloader (used on debug mode) on Windows.
    (OSError: [WinError 10038]). See pull request 1081
  • Partially revert change to class hierarchy of Headers. See 1084.

0.12

Released on March 10th 2017

  • Spit out big deprecation warnings for werkzeug.script
  • Use inspect.getfullargspec internally when available as
    inspect.getargspec is gone in 3.6
  • Added support for status code 451 and 423
  • Improved the build error suggestions. In particular only if
    someone stringifies the error will the suggestions be calculated.
  • Added support for uWSGI's caching backend.
  • Fix a bug where iterating over a FileStorage would result in an infinite
    loop.
  • Datastructures now inherit from the relevant baseclasses from the
    collections module in the stdlib. See 794.
  • Add support for recognizing NetBSD, OpenBSD, FreeBSD, DragonFlyBSD platforms
    in the user agent string.
  • Recognize SeaMonkey browser name and version correctly
  • Recognize Baiduspider, and bingbot user agents
  • If LocalProxy's wrapped object is a function, refer to it with wrapped
    attribute.
  • The defaults of generate_password_hash have been changed to more secure
    ones, see pull request 753.
  • Add support for encoding in options header parsing, see pull request
    933.
  • test.Client now properly handles Location headers with relative URLs, see
    pull request 879.
  • When HTTPException is raised, it now prints the description, for easier
    debugging.
  • Werkzeug's dict-like datastructures now have view-methods under Python 2,
    see pull request 968.
  • Fix a bug in MultiPartParser when no stream_factory was provided
    during initialization, see pull request 973.
  • Disable autocorrect and spellchecker in the debugger middleware's Python
    prompt, see pull request 994.
  • Don't redirect to slash route when method doesn't match, see pull request
    907.
  • Fix a bug when using SharedDataMiddleware with frozen packages, see pull
    request 959.
  • Range header parsing function fixed for invalid values 974.
  • Add support for byte Range Requests, see pull request 978.
  • Use modern cryptographic defaults in the dev servers 1004.
  • the post() method of the test client now accept file object through the data
    parameter.
  • Color run_simple's terminal output based on HTTP codes 1013.
  • Fix self-XSS in debugger console, see 1031.
  • Fix IPython 5.x shell support, see 1033.

0.11.16

  • werkzeug.serving: set CONTENT_TYPE / CONTENT_LENGTH if only they're provided by the client
  • werkzeug.serving: Fix crash of reloader when using python -m werkzeug.serving.

0.11.15

Released on December 30th 2016.

  • Bugfix for the bugfix in the previous release.

0.11.14

Released on December 30th 2016.

  • Check if platform can fork before importing ForkingMixIn, raise exception
    when creating ForkingWSGIServer on such a platform, see PR 999.

0.11.13

Released on December 26th 2016.

  • Correct fix for the reloader issuer on certain Windows installations.

0.11.12

Released on December 26th 2016.

  • Fix more bugs in multidicts regarding empty lists. See 1000.
  • Add some docstrings to some EnvironBuilder properties that were previously
    unintentionally missing.
  • Added a workaround for the reloader on windows.

0.11.11

Released on August 31st 2016.

  • Fix JSONRequestMixin for Python3. See 731
  • Fix broken string handling in test client when passing integers. See 852
  • Fix a bug in parse_options_header where an invalid content type
    starting with comma or semi-colon would result in an invalid return value,
    see issue 995.
  • Fix a bug in multidicts when passing empty lists as values, see issue
    979.
  • Fix a security issue that allows XSS on the Werkzeug debugger. See 1001.

0.11.10

Released on May 24th 2016.

  • Fixed a bug that occurs when running on Python 2.6 and using a broken locale.
    See pull request 912.
  • Fixed a crash when running the debugger on Google App Engine. See issue 925.
  • Fixed an issue with multipart parsing that could cause memory exhaustion.

0.11.9

Released on April 24th 2016.

  • Corrected an issue that caused the debugger not to use the
    machine GUID on POSIX systems.
  • Corrected a Unicode error on Python 3 for the debugger's
    PIN usage.
  • Corrected the timestamp verification in the pin debug code.
    Without this fix the pin was remembered for too long.

0.11.8

Released on April 15th 2016.

  • fixed a problem with the machine GUID detection code on OS X
    on Python 3.

0.11.7

Released on April 14th 2016.

  • fixed a regression on Python 3 for the debugger.

0.11.6

Released on April 14th 2016.

  • werkzeug.serving: Still show the client address on bad requests.
  • improved the PIN based protection for the debugger to make it harder to
    brute force via trying cookies. Please keep in mind that the debugger
    is not intended for running on production environments
  • increased the pin timeout to a week to make it less annoying for people
    which should decrease the chance that users disable the pin check
    entirely.
  • werkzeug.serving: Fix broken HTTP_HOST when path starts with double slash.

0.11.5

Released on March 22nd 2016.

  • werkzeug.serving: Fix crash when attempting SSL connection to HTTP server.

0.11.4

Released on February 14th 2016.

  • Fixed werkzeug.serving not working from -m flag.
  • Fixed incorrect weak etag handling.

0.11.3

Released on December 20th 2015.

  • Fixed an issue with copy operations not working against
    proxies.
  • Changed the logging operations of the development server to
    correctly log where the server is running in all situations
    again.
  • Fixed another regression with SSL wrapping similar to the
    fix in 0.11.2 but for a different code path.

0.11.2

Released on November 12th 2015.

  • Fix inheritable sockets on Windows on Python 3.
  • Fixed an issue with the forking server not starting any longer.
  • Fixed SSL wrapping on platforms that supported opening sockets
    by file descriptor.
  • No longer log from the watchdog reloader.
  • Unicode errors in hosts are now better caught or converted into
    bad request errors.

0.11.1

Released on November 10th 2015.

  • Fixed a regression on Python 3 in the debugger.

0.11

Released on November 8th 2015, codename Gleisbaumaschine.

  • Added reloader_paths option to run_simple and other functions in
    werkzeug.serving. This allows the user to completely override the Python
    module watching of Werkzeug with custom paths.
  • Many custom cached properties of Werkzeug's classes are now subclasses of
    Python's property type (issue 616).
  • bind_to_environ now doesn't differentiate between implicit and explicit
    default port numbers in HTTP_HOST (pull request 204).
  • BuildErrors are now more informative. They come with a complete sentence
    as error message, and also provide suggestions (pull request 691).
  • Fix a bug in the user agent parser where Safari's build number instead of
    version would be extracted (pull request 703).
  • Fixed issue where RedisCache set_many was broken for twemproxy, which doesn't
    support the default MULTI command (pull request 702).
  • mimetype parameters on request and response classes are now always
    converted to lowercase.
  • Changed cache so that cache never expires if timeout is 0. This also fixes
    an issue with redis setex (issue 550)
  • Werkzeug now assumes UTF-8 as filesystem encoding on Unix if Python
    detected it as ASCII.
  • New optional has method on caches.
  • Fixed various bugs in parse_options_header (pull request 643).
  • If the reloader is enabled the server will now open the socket in the parent
    process if this is possible. This means that when the reloader kicks in
    the connection from client will wait instead of tearing down. This does
    not work on all Python versions.
  • Implemented PIN based authentication for the debugger. This can optionally
    be disabled but is discouraged. This change was necessary as it has been
    discovered that too many people run the debugger in production.
  • Devserver no longer requires SSL module to be installed.

0.10.5

(bugfix release, release date yet to be decided)

  • Reloader: Correctly detect file changes made by moving temporary files over
    the original, which is e.g. the case with PyCharm (pull request 722).
  • Fix bool behavior of werkzeug.datastructures.ETags under Python 3 (issue
    744).

0.10.4

(bugfix release, released on March 26th 2015)

  • Re-release of 0.10.3 with packaging artifacts manually removed.

0.10.3

(bugfix release, released on March 26th 2015)

  • Re-release of 0.10.2 without packaging artifacts.

0.10.2

(bugfix release, released on March 26th 2015)

  • Fixed issue where empty could break third-party libraries that relied on
    keyword arguments (pull request 675)
  • Improved Rule.empty by providing a ```get_empty_kwargsto allow setting custom kwargs without having to override entireempty`` method. (pull
    request ``675``)
  • Fixed extra_files parameter for reloader to not cause startup
    to crash when included in server params
  • Using MultiDict when building URLs is now not supported again. The behavior
    introduced several regressions.
  • Fix performance problems with stat-reloader (pull request 715).

0.10.1

(bugfix release, released on February 3rd 2015)

  • Fixed regression with multiple query values for URLs (pull request 667).
  • Fix issues with eventlet's monkeypatching and the builtin server (pull
    request 663).

0.10

Released on January 30th 2015, codename Bagger.

  • Changed the error handling of and improved testsuite for the caches in
    contrib.cache.
  • Fixed a bug on Python 3 when creating adhoc ssl contexts, due to sys.maxint
    not being defined.
  • Fixed a bug on Python 3, that caused
    :func:~werkzeug.serving.make_ssl_devcert to fail with an exception.
  • Added exceptions for 504 and 505.
  • Added support for ChromeOS detection.
  • Added UUID converter to the routing system.
  • Added message that explains how to quit the server.
  • Fixed a bug on Python 2, that caused len for
    :class:werkzeug.datastructures.CombinedMultiDict to crash.
  • Added support for stdlib pbkdf2 hmac if a compatible digest
    is found.
  • Ported testsuite to use py.test.
  • Minor optimizations to various middlewares (pull requests 496 and
    571).
  • Use stdlib ssl module instead of OpenSSL for the builtin server
    (issue 434). This means that OpenSSL contexts are not supported anymore,
    but instead ssl.SSLContext from the stdlib.
  • Allow protocol-relative URLs when building external URLs.
  • Fixed Atom syndication to print time zone offset for tz-aware datetime
    objects (pull request 254).
  • Improved reloader to track added files and to recover from broken
    sys.modules setups with syntax errors in packages.
  • cache.RedisCache now supports arbitrary **kwargs for the redis
    object.
  • werkzeug.test.Client now uses the original request method when resolving
    307 redirects (pull request 556).
  • werkzeug.datastructures.MIMEAccept now properly deals with mimetype
    parameters (pull request 205).
  • werkzeug.datastructures.Accept now handles a quality of 0 as
    intolerable, as per RFC 2616 (pull request 536).
  • werkzeug.urls.url_fix now properly encodes hostnames with idna
    encoding (issue 559). It also doesn't crash on malformed URLs anymore
    (issue 582).
  • werkzeug.routing.MapAdapter.match now recognizes the difference between
    the path / and an empty one (issue 360).
  • The interactive debugger now tries to decode non-ascii filenames (issue
    469).
  • Increased default key size of generated SSL certificates to 1024 bits (issue
    611).
  • Added support for specifying a Response subclass to use when calling
    :func:~werkzeug.utils.redirect\ .
  • werkzeug.test.EnvironBuilder now doesn't use the request method anymore
    to guess the content type, and purely relies on the form, files and
    input_stream properties (issue 620).
  • Added Symbian to the user agent platform list.
  • Fixed make_conditional to respect automatically_set_content_length
  • Unset Content-Length when writing to response.stream (issue 451)
  • wrappers.Request.method is now always uppercase, eliminating
    inconsistencies of the WSGI environment (issue 647).
  • routing.Rule.empty now works correctly with subclasses of Rule (pull
    request 645).
  • Made map updating safe in light of concurrent updates.
  • Allow multiple values for the same field for url building (issue 658).

0.9.7

  • Fixed uri_to_iri() not re-encoding hashes in query string parameters.

0.9.6

(bugfix release, released on June 7th 2014)

  • Added a safe conversion for IRI to URI conversion and use that
    internally to work around issues with spec violations for
    protocols such as itms-service.

0.9.5

(bugfix release, released on June 7th 2014)

  • Forward charset argument from request objects to the environ
    builder.
  • Fixed error handling for missing boundaries in multipart data.
  • Fixed session creation on systems without os.urandom().
  • Fixed pluses in dictionary keys not being properly URL encoded.
  • Fixed a problem with deepcopy not working for multi dicts.
  • Fixed a double quoting issue on redirects.
  • Fixed a problem with unicode keys appearing in headers on 2.x.
  • Fixed a bug with unicode strings in the test builder.
  • Fixed a unicode bug on Python 3 in the WSGI profiler.
  • Fixed an issue with the safe string compare function on
    Python 2.7.7 and Python 3.4.

0.9.4

(bugfix release, released on August 26th 2013)

  • Fixed an issue with Python 3.3 and an edge case in cookie parsing.
  • Fixed decoding errors not handled properly through the WSGI
    decoding dance.
  • Fixed URI to IRI conversion incorrectly decoding percent signs.

0.9.3

(bugfix release, released on July 25th 2013)

  • Restored behavior of the data descriptor of the request class to pre 0.9
    behavior. This now also means that .data and .get_data() have
    different behavior. New code should use .get_data() always.

In addition to that there is now a flag for the .get_data() method that
controls what should happen with form data parsing and the form parser will
honor cached data. This makes dealing with custom form data more consistent.

0.9.2

(bugfix release, released on July 18th 2013)

  • Added unsafe parameter to :func:~werkzeug.urls.url_quote.
  • Fixed an issue with :func:~werkzeug.urls.url_quote_plus not quoting
    '+' correctly.
  • Ported remaining parts of :class:~werkzeug.contrib.RedisCache to
    Python 3.3.
  • Ported remaining parts of :class:~werkzeug.contrib.MemcachedCache to
    Python 3.3
  • Fixed a deprecation warning in the contrib atom module.
  • Fixed a regression with setting of content types through the
    headers dictionary instead with the content type parameter.
  • Use correct name for stdlib secure string comparison function.
  • Fixed a wrong reference in the docstring of
    :func:~werkzeug.local.release_local.
  • Fixed an AttributeError that sometimes occurred when accessing the
    :attr:werkzeug.wrappers.BaseResponse.is_streamed attribute.

0.9.1

(bugfix release, released on June 14th 2013)

  • Fixed an issue with integers no longer being accepted in certain
    parts of the routing system or URL quoting functions.
  • Fixed an issue with url_quote not producing the right escape
    codes for single digit codepoints.
  • Fixed an issue with :class:~werkzeug.wsgi.SharedDataMiddleware not
    reading the path correctly and breaking on etag generation in some
    cases.
  • Properly handle Expect: 100-continue in the development server
    to resolve issues with curl.
  • Automatically exhaust the input stream on request close. This should
    fix issues where not touching request files results in a timeout.
  • Fixed exhausting of streams not doing anything if a non-limited
    stream was passed into the multipart parser.
  • Raised the buffer sizes for the multipart parser.

0.9

Released on June 13nd 2013, codename Planierraupe.

  • Added support for :meth:~werkzeug.wsgi.LimitedStream.tell
    on the limited stream.
  • :class:~werkzeug.datastructures.ETags now is nonzero if it
    contains at least one etag of any kind, including weak ones.
  • Added a workaround for a bug in the stdlib for SSL servers.
  • Improved SSL interface of the devserver so that it can generate
    certificates easily and load them from files.
  • Refactored test client to invoke the open method on the class
    for redirects. This makes subclassing more powerful.
  • :func:werkzeug.wsgi.make_chunk_iter and
    :func:werkzeug.wsgi.make_line_iter now support processing of
    iterators and streams.
  • URL generation by the routing system now no longer quotes
    +.
  • URL fixing now no longer quotes certain reserved characters.
  • The :func:werkzeug.security.generate_password_hash and
    check functions now support any of the hashlib algorithms.
  • wsgi.get_current_url is now ascii safe for browsers sending
    non-ascii data in query strings.
  • improved parsing behavior for :func:werkzeug.http.parse_options_header
  • added more operators to local proxies.
  • added a hook to override the default converter in the routing
    system.
  • The description field of HTTP exceptions is now always escaped.
    Use markup objects to disable that.
  • Added number of proxy argument to the proxy fix to make it more
    secure out of the box on common proxy setups. It will by default
    no longer trust the x-forwarded-for header as much as it did
    before.
  • Added support for fragment handling in URI/IRI functions.
  • Added custom class support for :func:werkzeug.http.parse_dict_header.
  • Renamed LighttpdCGIRootFix to CGIRootFix.
  • Always treat + as safe when fixing URLs as people love misusing them.
  • Added support to profiling into directories in the contrib profiler.
  • The escape function now by default escapes quotes.
  • Changed repr of exceptions to be less magical.
  • Simplified exception interface to no longer require environments
    to be passed to receive the response object.
  • Added sentinel argument to IterIO objects.
  • Added pbkdf2 support for the security module.
  • Added a plain request type that disables all form parsing to only
    leave the stream behind.
  • Removed support for deprecated fix_headers.
  • Removed support for deprecated header_list.
  • Removed support for deprecated parameter for iter_encoded.
  • Removed support for deprecated non-silent usage of the limited
    stream object.
  • Removed support for previous dummy writable parameter on
    the cached property.
  • Added support for explicitly closing request objects to close
    associated resources.
  • Conditional request handling or access to the data property on responses no
    longer ignores direct passthrough mode.
  • Removed werkzeug.templates and werkzeug.contrib.kickstart.
  • Changed host lookup logic for forwarded hosts to allow lists of
    hosts in which case only the first one is picked up.
  • Added wsgi.get_query_string, wsgi.get_path_info and
    wsgi.get_script_name and made the wsgi.pop_path_info and
    wsgi.peek_path_info functions perform unicode decoding. This
    was necessary to avoid having to expose the WSGI encoding dance
    on Python 3.
  • Added content_encoding and content_md5 to the request object's
    common request descriptor mixin.
  • added options and trace to the test client.
  • Overhauled the utilization of the input stream to be easier to use
    and better to extend. The detection of content payload on the input
    side is now more compliant with HTTP by detecting off the content
    type header instead of the request method. This also now means that
    the stream property on the request class is always available instead
    of just when the parsing fails.
  • Added support for using :class:werkzeug.wrappers.BaseResponse in a with
    statement.
  • Changed get_app_iter to fetch the response early so that it does not
    fail when wrapping a response iterable. This makes filtering easier.
  • Introduced get_data and set_data methods for responses.
  • Introduced get_data for requests.
  • Soft deprecated the data descriptors for request and response objects.
  • Added as_bytes operations to some of the headers to simplify working
    with things like cookies.
  • Made the debugger paste tracebacks into github's gist service as
    private pastes.

0.8.4

(bugfix release, release date to be announced)

  • Added a favicon to the debugger which fixes problem with
    state changes being triggered through a request to
    /favicon.ico in Google Chrome. This should fix some
    problems with Flask and other frameworks that use
    context local objects on a stack with context preservation
    on errors.
  • Fixed an issue with scrolling up in the debugger.
  • Fixed an issue with debuggers running on a different URL
    than the URL root.
  • Fixed a problem with proxies not forwarding some rarely
    used special methods properly.
  • Added a workaround to prevent the XSS protection from Chrome
    breaking the debugger.
  • Skip redis tests if redis is not running.
  • Fixed a typo in the multipart parser that caused content-type
    to not be picked up properly.

Got merge conflicts? Close this PR and delete the branch. I'll create a new PR for you.

Happy merging! 🤖

@pyup-bot pyup-bot mentioned this pull request Dec 7, 2017
Closed
@pyup-bot
Copy link
Collaborator Author

Closing this in favor of #16

@pyup-bot pyup-bot closed this Dec 31, 2017
@gregorynicholas gregorynicholas deleted the pyup-update-werkzeug-0.8.3-to-0.13 branch December 31, 2017 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@pyup-bot