Skip to content

Bump werkzeug from 3.1.8 to 3.1.9 - #284

Merged
Radhika Gupta (rads-1996) merged 1 commit into
mainfrom
dependabot/uv/werkzeug-3.1.9
Oct 7, 2026
Merged

Bump werkzeug from 3.1.8 to 3.1.9#284
Radhika Gupta (rads-1996) merged 1 commit into
mainfrom
dependabot/uv/werkzeug-3.1.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps werkzeug from 3.1.8 to 3.1.9.

Release notes

Sourced from werkzeug's releases.

3.1.9

This is the Werkzeug 3.1.9 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.9/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9 Milestone: https://github.com/pallets/werkzeug/milestone/46?closed=1

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. GHSA-g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. #3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. #3189
  • Improve performance of parse_options_header. #3231
  • Improve performance of parse_etags. #3231
  • Improve performance of parse_cookie. #3231
  • get_host also checks that the port is in the valid range. #3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). #3237
  • Improve debugger PIN generation from cgroup data inside Podman. #3245
  • Authorization parsing basic auth disallows non-base64 characters. #3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. #3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. #3253
  • Rules with 10 or more converters in a single part assign matched values correctly. #3254
  • The invalid Range suffix length -0 is no longer accepted. #3255
Changelog

Sourced from werkzeug's changelog.

Version 3.1.9

Released 2026-09-27

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. :ghsa:g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. :issue:3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. :issue:3189
  • Improve performance of parse_options_header. :pr:3231
  • Improve performance of parse_etags. :pr:3231
  • Improve performance of parse_cookie. :pr:3231
  • get_host also checks that the port is in the valid range. :pr:3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). :issue:3237
  • Improve debugger PIN generation from cgroup data inside Podman. :issue:3245
  • Authorization parsing basic auth disallows non-base64 characters. :pr:3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. :pr:3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. :pr:3253
  • Rules with 10 or more converters in a single part assign matched values correctly. :pr:3254
  • The invalid Range suffix length -0 is no longer accepted. :pr:3255
Commits

Copilot AI balanced review requested due to automatic review settings October 7, 2026 20:20
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 7, 2026
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Oct 7, 2026
Copilot AI reviewed Oct 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@github-actions

github-actions Bot commented Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Performance comparison

Threshold: regressions >15.0% on gating scenarios fail the build. Higher ops/s is better; positive Δ means the PR is slower.

Scenario Gating Baseline (ops/s) Candidate (ops/s) Δ % Status
azure_monitor_log yes 28,015.9 28,278.1 -0.93% ✅
azure_monitor_span yes 160,539.4 158,503.7 +1.28% ✅
otel_log no 32,792.3 32,272.6 +1.61% ✅
otel_span no 48,612.1 49,210.2 -1.22% ✅

@rads-1996 Radhika Gupta (rads-1996) added the skip-changelog Not required for changes to test files, github actions, etc. label Oct 7, 2026
@rads-1996

Radhika Gupta (rads-1996) commented Oct 7, 2026

Copy link
Copy Markdown
Member

Dependabot (@dependabot) rebase .

Copilot AI balanced review requested due to automatic review settings October 7, 2026 21:28
@dependabot
dependabot Bot force-pushed the dependabot/uv/werkzeug-3.1.9 branch from b5861cc to 2ff1f93 Compare October 7, 2026 21:28
Copilot AI reviewed Oct 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@rads-1996

Radhika Gupta (rads-1996) commented Oct 7, 2026

Copy link
Copy Markdown
Member

Dependabot (@dependabot) rebase .

@dependabot
Bump werkzeug from 3.1.8 to 3.1.9
1a0e903 
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.8 to 3.1.9.
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.8...3.1.9)

---
updated-dependencies:
- dependency-name: werkzeug
  dependency-version: 3.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI balanced review requested due to automatic review settings October 7, 2026 22:07
@dependabot
dependabot Bot force-pushed the dependabot/uv/werkzeug-3.1.9 branch from 2ff1f93 to 1a0e903 Compare October 7, 2026 22:07
Copilot AI reviewed Oct 7, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

@rads-1996
Radhika Gupta (rads-1996) merged commit 4e6899c into main Oct 7, 2026
12 checks passed
@rads-1996
Radhika Gupta (rads-1996) deleted the dependabot/uv/werkzeug-3.1.9 branch October 7, 2026 22:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@rads-1996 Radhika Gupta (rads-1996) rads-1996 approved these changes
@hectorhdzg Hector Hernandez (hectorhdzg) Awaiting requested review from hectorhdzg hectorhdzg is a code owner
@JacksonWeber Jackson Weber (JacksonWeber) Awaiting requested review from JacksonWeber JacksonWeber is a code owner
@lzchen Leighton Chen (lzchen) Awaiting requested review from lzchen lzchen is a code owner
@MSNev Nev (MSNev) Awaiting requested review from MSNev MSNev is a code owner
@jeremydvoss Jeremy Voss (jeremydvoss) Awaiting requested review from jeremydvoss jeremydvoss is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code skip-changelog Not required for changes to test files, github actions, etc.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@rads-1996