Werkzeug is a comprehensive Python WSGI web application library, providing utilities for building and testing web apps. It includes tools for requests and responses, routing and URL generation, HTTP helpers, a development WSGI server, and an interactive debugger.
Project status
- The upstream (pallets/werkzeug) appears actively maintained, with multiple recent
updatesin the 3.1.x line that include security and bugfix work. - Apparent update cadence is roughly monthly in recent months, with updates on 2026-02-19 (3.1.6), 2026-03-24 (3.1.7), 2026-04-02 (3.1.8), and a newer upstream push on 2026-05-05.
AI summary generated
Recent updates
3.1.8
Werkzeug 3.1.8 is a fix release that primarily changes host handling behavior in Request.host and get_host when the Host header is missing or contains invalid characters. The code diff is small, focused on src/werkzeug/sansio/utils.py plus corresponding test and documentation updates.
3.1.7
Werkzeug 3.1.7 is a bugfix release that focuses on HTTP parsing correctness (list/dict header parsing, Transfer-Encoding parsing), request host validation, multipart boundary handling, conditional range headers, and improved slash-merging behavior. The release notes describe the user-visible fixes, and the code largely matches those points.
3.1.6
Werkzeug 3.1.6 is a security release. The documented change hardens `safe_join` on Windows to reject special device names when they appear in multi-segment (slash-containing) untrusted paths. The code diff also shows additional security-related internal adjustments beyond what is stated in the release notes.
Security3.1.5
Werkzeug 3.1.5 is a security and bug fix release. It primarily tightens Windows path handling in `safe_join`, improves multipart form parsing across chunk boundaries, and fixes an `AttributeError` when constructing `DebuggedApplication` with `pin_security=False`.
BreakingSecurity3.1.4
Werkzeug 3.1.4 is a patch release focused on bug fixes, including safer path joining on Windows, improved multipart parsing at chunk boundaries, and debugger/traceback fixes. The release notes claim no other behavior changes beyond these items.
Security3.1.3
Werkzeug 3.1.3 is a bug fix release. The main documented changes are stricter handling of “multi value” inputs to MultiDict and similar data structures, and correct bracket-wrapping of IPv6 SERVER_NAME values when falling back for Request.host.
3.1.2
Werkzeug 3.1.2 is a fix release focused on improving type hints with minimal to no intended runtime behavior changes from 3.1.0. The release notes specifically call out updated typing for the `type` conversion callable and correcting the `Headers` class hierarchy.
Breaking3.1.1
Werkzeug 3.1.1 is a small maintenance release that primarily fixes a bug where `str(Request.headers)` incorrectly appeared empty. The code change is localized to header string rendering, along with a new regression test and a version bump.
3.1.0
Werkzeug 3.1.0 is a feature release that includes several deprecations and potentially breaking behavior changes, especially around request form size limits and cache-control directive parsing/typing. It also updates security posture by increasing PBKDF2 work factor, and modernizes the datastructures API surface with operator support and inlined typing.
BreakingSecurityFeatures3.0.6
Werkzeug 3.0.6 is a security-focused release that addresses two issues: multipart form parsing memory-limit enforcement for non-file fields, and improved path validation in `safe_join`. The changes are intended to fix security vulnerabilities without otherwise changing behavior.
Security