Update dependency Werkzeug to v3.1.9 - #4

v3.1.9

Compare Source

Released 2026-09-27

• safe_join on Windows does not allow special devices names with empty ADS
  markers on NTFS. :ghsa:g6x2-hccm-hh4m
• ProfilerMiddleware uses profiling.tracing on Python 3.15.
  :issue:3207
• uri_to_iri and iri_to_uri preserve empty username, password, and
  port 0. :issue:3189
• Improve performance of parse_options_header. :pr:3231
• Improve performance of parse_etags. :pr:3231
• Improve performance of parse_cookie. :pr:3231
• get_host also checks that the port is in the valid range. :pr:3236
• The int URL converter returns a 404 instead of 500 error when the value
  is longer than sys.get_int_max_str_digits(). :issue:3237
• Improve debugger PIN generation from cgroup data inside Podman.
  :issue:3245
• Authorization parsing basic auth disallows non-base64 characters.
  :pr:3248
• application/x-www-form-urlencoded form data is no longer limited to
  max_form_memory_size, only max_content_length. :pr:3251
• LimitedStream.readinto does not resize the buffer when it reads less
  than the remaining size. :pr:3253
• Rules with 10 or more converters in a single part assign matched values
  correctly. :pr:3254
• The invalid Range suffix length -0 is no longer accepted. :pr:3255

v3.1.8

Compare Source

Released 2026-04-02

• Request.host and get_host return the empty string if the header is
  missing or has invalid characters. :issue:3142

v3.1.7

Compare Source

Released 2026-03-23

• parse_list_header preserves partially quoted items, discards empty
  items, and returns empty for unclosed quoted values. :pr:3128
• WWWAuthenticate.to_header does not produce a trailing space when there
  are no parameters. :issue:3127
• Transfer-Encoding is parsed as a set. :pr:3134
• Request.host, get_host, and host_is_trusted validate the
  characters of the value. An empty value is no longer allowed. A Unix socket
  server address is ignored. The trusted_list argument to
  host_is_trusted is optional. :pr:3113
• Fix multipart form parser handling of newline at boundary. :issue:3088
• Response.make_conditional sets the Accept-Ranges header even if it
  is not a satisfiable range request. :issue:3108
• merge_slashes merges any number of consecutive slashes. :issue:3121

v3.1.6

Compare Source

Released 2026-02-19

• safe_join on Windows does not allow special devices names in
  multi-segment paths. :ghsa:29vq-49wr-vm6x
• Response.make_conditional sets the Accept-Ranges header even if it
  is not a satisfiable range request. :issue:3108

v3.1.5

Compare Source

Released 2026-01-08

• safe_join on Windows does not allow more special device names, regardless
  of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  This fixes the previous attempt, which caused incorrect content lengths.
  :issue:3065 :issue:3077
• Fix AttributeError when initializing DebuggedApplication with
  pin_security=False. :issue:3075

v3.1.4

Compare Source

Released 2025-11-28

• safe_join on Windows does not allow special device names. This prevents
  reading from these when using send_from_directory. secure_filename
  already prevented writing to these. :ghsa:hgf8-39gv-g3f2
• The debugger pin fails after 10 attempts instead of 11. :pr:3020
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  :issue:3065
• Improve CPU usage during Watchdog reloader. :issue:3054
• Request.json annotation is more accurate. :issue:3067
• Traceback rendering handles when the line number is beyond the available
  source lines. :issue:3044
• HTTPException.get_response annotation and doc better conveys the
  distinction between WSGI and sans-IO responses. :issue:3056