Changes — Flask Documentation (3.1.x)

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726
stream_with_context does not fail inside async views. #5774
When using follow_redirects in the test client, the final state of session is correct. #5786
Relax type hint for passing bytes IO to send_file. #5776
Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
Fix type hint for cli_runner.invoke. #5645
flask --help loads the app and plugins first to make sure all commands are shown. #5673
Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Drop support for Python 3.8. #5623
Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624,5633
Provide a configuration option to control automatic option responses. #5496
Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504
Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625
Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472
-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628
Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621
Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553
Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636
The default hashlib.sha1 may not be available in FIPS builds. Don’t access it at import time so the developer has time to change the default. #5448
Don’t initialize the cli attribute in the sansio scaffold, but rather in the Flask concrete class. #5270
Correct type for jinja_loader property. #5388
Fix error with --extra-files and --exclude-patterns CLI options. #5391
Correct type for path argument to send_file. #5336
Fix a typo in an error message for the flask run --key option. #5344
Session data is untagged without relying on the built-in json.loads object_hook. This allows other JSON providers that don’t implement that. #5381
Address more type findings when using mypy strict mode. #5383
Remove previously deprecated code. #5223
Deprecate the __version__ attribute. Use feature detection, or importlib.metadata.version("flask"), instead. #5230
Restructure the code such that the Flask (app) and Blueprint classes have Sans-IO bases. #5127
Allow self as an argument to url_for. #5264
Require Werkzeug >= 3.0.0.
Python 3.12 compatibility.
Require Werkzeug >= 2.3.7.
Use flit_core instead of setuptools as build backend.
Refactor how an app’s root and instance paths are determined. #5160
Set Vary: Cookie header when the session is accessed, modified, or refreshed.
Update Werkzeug requirement to >=2.3.3 to apply recent bug fixes. GHSA-m2qf-hxjv-5gpq
Restore deprecated from flask import Markup. #5084
Drop support for Python 3.7. #5072
Update minimum requirements to the latest versions: Werkzeug>=2.3.0, Jinja2>3.1.2, itsdangerous>=2.1.2, click>=8.1.3.