Skip to content

Bump flask from 3.1.2 to 3.1.3#72

Closed
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/pip/dev/flask-3.1.3
Closed

Bump flask from 3.1.2 to 3.1.3#72
dependabot[bot] wants to merge 1 commit intodevfrom
dependabot/pip/dev/flask-3.1.3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026 •
edited
Loading

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps flask from 3.1.2 to 3.1.3.

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 30, 2026
@dependabot
Bump flask from 3.1.2 to 3.1.3
45a7b03 
Bumps [flask](https://github.com/pallets/flask) from 3.1.2 to 3.1.3.
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.2...3.1.3)

---
updated-dependencies:
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/dev/flask-3.1.3 branch from 4f11932 to 45a7b03 Compare April 22, 2026 13:05
Bentlybro added a commit that referenced this pull request Apr 22, 2026
@Bentlybro
Bump deps: Flask 3.1.3, Werkzeug 3.1.8, Authlib 1.7, pydantic 2.13.2,…
e7418eb 
… etc.

Rolls up the open dependabot PRs #65, #66, #69, #72, #73, #74, #75, #76
into a single commit. Each bump is a minor/patch release with no breaking
changes relevant to this codebase; all chat.completions / Flask-SocketIO
/ pydantic-v1-validator usage continues to work.

- Flask[async]       3.1.2 -> 3.1.3   (#65, #72)
- Flask-SocketIO     5.6.0 -> 5.6.1   (#66)
- Werkzeug           3.1.5 -> 3.1.8   (#73; supersedes master-targeting #67
                                        which wanted 3.1.6)
- python-dotenv      1.2.1 -> 1.2.2   (#69)
- requests           2.32.5 -> 2.33.1 (#74)
- pydantic           2.12.5 -> 2.13.2 (#76)
- Authlib            1.6.8 -> 1.7.0   (#75)

Doing this as one commit on dev because dev has diverged from master
(Phase 0 + Phase 1 security/architectural work) and each dependabot PR
has a requirements.txt conflict against the new pins we added — resolving
8 of those by hand is more churn than just bumping the versions directly.
@Bentlybro
Copy link
Copy Markdown
Member

Bentlybro commented Apr 22, 2026

Superseded by e7418eb on dev, which rolls this bump up with the rest of the open dependabot PRs into a single commit. Needed because dev has diverged from master with Phase 0 + Phase 1 work and resolving 8 individual requirements.txt conflicts is more churn than a direct bump. Thanks @dependabot 🤖

@Bentlybro Bentlybro closed this Apr 22, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 22, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/pip/dev/flask-3.1.3 branch April 22, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Bentlybro