Subject: CVS commit: pkgsrc/www
From: Thomas Klausner
Date: 2022-04-29 15:36:20
Message id:

Log Message:
py-werkzeug*: update to 2.1.2

Version 2.1.2

Released 2022-04-28

-   The development server does not set ``Transfer-Encoding: chunked``
    for 1xx, 204, 304, and HEAD responses. :issue:`2375`
-   Response HTML for exceptions and redirects starts with
    ``<!doctype html>`` and ``<html lang=en>``. :issue:`2390`
-   Fix ability to set some ``cache_control`` attributes to ``False``.
-   Disable ``keep-alive`` connections in the development server, which
    are not supported sufficiently by Python's ``http.server``.

Version 2.1.1

Released 2022-04-01

-   ``ResponseCacheControl.s_maxage`` converts its value to an int, like
    ``max_age``. :issue:`2364`

Version 2.1.0

Released 2022-03-28

-   Drop support for Python 3.6. :pr:`2277`
-   Using gevent or eventlet requires greenlet>=1.0 or PyPy>=7.3.7.
    ``werkzeug.locals`` and ``contextvars`` will not work correctly with
    older versions. :pr:`2278`
-   Remove previously deprecated code. :pr:`2276`

    -   Remove the non-standard ``shutdown`` function from the WSGI
        environ when running the development server. See the docs for
    -   Request and response mixins have all been merged into the
        ``Request`` and ``Response`` classes.
    -   The user agent parser and the ``useragents`` module is removed.
        The ``user_agent`` module provides an interface that can be
        subclassed to add a parser, such as ua-parser. By default it
        only stores the whole string.
    -   The test client returns ``TestResponse`` instances and can no
        longer be treated as a tuple. All data is available as
        properties on the response.
    -   Remove ``locals.get_ident`` and related thread-local code from
        ``locals``, it no longer makes sense when moving to a
        contextvars-based implementation.
    -   Remove the ``python -m werkzeug.serving`` CLI.
    -   The ``has_key`` method on some mapping datastructures; use
        ``key in data`` instead.
    -   ``Request.disable_data_descriptor`` is removed, pass
        ``shallow=True`` instead.
    -   Remove the ``no_etag`` parameter from ``Response.freeze()``.
    -   Remove the ``HTTPException.wrap`` class method.
    -   Remove the ``cookie_date`` function. Use ``http_date`` instead.
    -   Remove the ``pbkdf2_hex``, ``pbkdf2_bin``, and ``safe_str_cmp``
        functions. Use equivalents in ``hashlib`` and ``hmac`` modules
    -   Remove the ``Href`` class.
    -   Remove the ``HTMLBuilder`` class.
    -   Remove the ``invalidate_cached_property`` function. Use
        ``del obj.attr`` instead.
    -   Remove ``bind_arguments`` and ``validate_arguments``. Use
        :meth:`Signature.bind` and :func:`inspect.signature` instead.
    -   Remove ``detect_utf_encoding``, it's built-in to ``json.loads``.
    -   Remove ``format_string``, use :class:`string.Template` instead.
    -   Remove ``escape`` and ``unescape``. Use MarkupSafe instead.

-   The ``multiple`` parameter of ``parse_options_header`` is
    deprecated. :pr:`2357`
-   Rely on :pep:`538` and :pep:`540` to handle decoding file names
    with the correct filesystem encoding. The ``filesystem`` module is
    removed. :issue:`1760`
-   Default values passed to ``Headers`` are validated the same way
    values added later are. :issue:`1608`
-   Setting ``CacheControl`` int properties, such as ``max_age``, will
    convert the value to an int. :issue:`2230`
-   Always use ``socket.fromfd`` when restarting the dev server.
-   When passing a dict of URL values to ````, list values do
    not filter out ``None`` or collapse to a single value. Passing a
    ``MultiDict`` does collapse single items. This undoes a previous
    change that made it difficult to pass a list, or ``None`` values in
    a list, to custom URL converters. :issue:`2249`
-   ``run_simple`` shows instructions for dealing with "address already
    in use" errors, including extra instructions for macOS. :pr:`2321`
-   Extend list of characters considered always safe in URLs based on
    :rfc:`3986`. :issue:`2319`
-   Optimize the stat reloader to avoid watching unnecessary files in
    more cases. The watchdog reloader is still recommended for
    performance and accuracy. :issue:`2141`
-   The development server uses ``Transfer-Encoding: chunked`` for
    streaming responses when it is configured for HTTP/1.1.
    :issue:`2090, 1327`, :pr:`2091`
-   The development server uses HTTP/1.1, which enables keep-alive
    connections and chunked streaming responses, when ``threaded`` or
    ``processes`` is enabled. :pr:`2323`
-   ``cached_property`` works for classes with ``__slots__`` if a
    corresponding ``_cache_{name}`` slot is added. :pr:`2332`
-   Refactor the debugger traceback formatter to use Python's built-in
    ``traceback`` module as much as possible. :issue:`1753`
-   The ``TestResponse.text`` property is a shortcut for
    ``r.get_data(as_text=True)``, for convenient testing against text
    instead of bytes. :pr:`2337`
-   ``safe_join`` ensures that the path remains relative if the trusted
    directory is the empty string. :pr:`2349`
-   Percent-encoded newlines (``%0a``), which are decoded by WSGI
    servers, are considered when routing instead of terminating the
    match early. :pr:`2350`
-   The test client doesn't set duplicate headers for ``CONTENT_LENGTH``
    and ``CONTENT_TYPE``. :pr:`2348`
-   ``append_slash_redirect`` handles ``PATH_INFO`` with internal
    slashes. :issue:`1972`, :pr:`2338`
-   The default status code for ``append_slash_redirect`` is 308 instead
    of 301. This preserves the request body, and matches a previous
    change to ``strict_slashes`` in routing. :issue:`2351`
-   Fix ``ValueError: I/O operation on closed file.`` with the test
    client when following more than one redirect. :issue:`2353`
-   ``Response.autocorrect_location_header`` is disabled by default.
    The ``Location`` header URL will remain relative, and exclude the
    scheme and domain, by default. :issue:`2352`
-   ``Request.get_json()`` will raise a 400 ``BadRequest`` error if the
    ``Content-Type`` header is not ``application/json``. This makes a
    very common source of confusion more visible. :issue:`2339`

Version 2.0.3

Released 2022-02-07

-   ``ProxyFix`` supports IPv6 addresses. :issue:`2262`
-   Type annotation for ``Response.make_conditional``,
    ``HTTPException.get_response``, and ``Map.bind_to_environ`` accepts
    ``Request`` in addition to ``WSGIEnvironment`` for the first
    parameter. :pr:`2290`
-   Fix type annotation for ``Request.user_agent_class``. :issue:`2273`
-   Accessing ``LocalProxy.__class__`` and ``__doc__`` on an unbound
    proxy returns the fallback value instead of a method object.
-   Redirects with the test client set ``RAW_URI`` and ``REQUEST_URI``
    correctly. :issue:`2151`

Version 2.0.2

Released 2021-10-05

-   Handle multiple tokens in ``Connection`` header when routing
    WebSocket requests. :issue:`2131`
-   Set the debugger pin cookie secure flag when on https. :pr:`2150`
-   Fix type annotation for ``MultiDict.update`` to accept iterable
    values :pr:`2142`
-   Prevent double encoding of redirect URL when ``merge_slash=True``
    for ``Rule.match``. :issue:`2157`
-   ``CombinedMultiDict.to_dict`` with ``flat=False`` considers all
    component dicts when building value lists. :issue:`2189`
-   ``send_file`` only sets a detected ``Content-Encoding`` if
    ``as_attachment`` is disabled to avoid browsers saving
    decompressed ``.tar.gz`` files. :issue:`2149`
-   Fix type annotations for ``TypeConversionDict.get`` to not return an
    ``Optional`` value if both ``default`` and ``type`` are not
    ``None``. :issue:`2169`
-   Fix type annotation for routing rule factories to accept
    ``Iterable[RuleFactory]`` instead of ``Iterable[Rule]`` for the
    ``rules`` parameter. :issue:`2183`
-   Add missing type annotation for ``FileStorage.__getattr__``
-   The debugger pin cookie is set with ``SameSite`` set to ``Strict``
    instead of ``None`` to be compatible with modern browser security.
-   Type annotations use ``IO[bytes]`` and ``IO[str]`` instead of
    ``BinaryIO`` and ``TextIO`` for wider type compatibility.
-   Ad-hoc TLS certs are generated with SAN matching CN. :issue:`2158`
-   Fix memory usage for locals when using Python 3.6 or pre 0.4.17
    greenlet versions. :pr:`2212`
-   Fix type annotation in ``CallbackDict``, because it is not
    utilizing a bound TypeVar. :issue:`2235`
-   Fix setting CSP header options on the response. :pr:`2237`
-   Fix an issue with with the interactive debugger where lines would
    not expand on click for very long tracebacks. :pr:`2239`
-   The interactive debugger handles displaying an exception that does
    not have a traceback, such as from ``ProcessPoolExecutor``.

Version 2.0.1

Released 2021-05-17

-   Fix type annotation for ``send_file`` ``max_age`` callable. Don't
    pass ``pathlib.Path`` to ``max_age``. :issue:`2119`
-   Mark top-level names as exported so type checking understands
    imports in user projects. :issue:`2122`
-   Fix some types that weren't available in Python 3.6.0. :issue:`2123`
-   ``cached_property`` is generic over its return type, properties
    decorated with it report the correct type. :issue:`2113`
-   Fix multipart parsing bug when boundary contains special regex
    characters. :issue:`2125`
-   Type checking understands that calling ``headers.get`` with a string
    default will always return a string. :issue:`2128`
-   If ``HTTPException.description`` is not a string,
    ``get_description`` will convert it to a string. :issue:`2115`

Version 2.0.0

Released 2021-05-11

-   Drop support for Python 2 and 3.5. :pr:`1693`
-   Deprecate :func:`utils.format_string`, use :class:`string.Template`
    instead. :issue:`1756`
-   Deprecate :func:`utils.bind_arguments` and
    :func:`utils.validate_arguments`, use :meth:`Signature.bind` and
    :func:`inspect.signature` instead. :issue:`1757`
-   Deprecate :class:`utils.HTMLBuilder`. :issue:`1761`
-   Deprecate :func:`utils.escape` and :func:`utils.unescape`, use
    MarkupSafe instead. :issue:`1758`
-   Deprecate the undocumented ``python -m werkzeug.serving`` CLI.
-   Deprecate the ``environ["werkzeug.server.shutdown"]`` function
    that is available when running the development server. :issue:`1752`
-   Deprecate the ``useragents`` module and the built-in user agent
    parser. Use a dedicated parser library instead by subclassing
    ``user_agent.UserAgent`` and setting ``Request.user_agent_class``.
-   Remove the unused, internal ``posixemulation`` module. :issue:`1759`
-   All ``datetime`` values are timezone-aware with
    ``tzinfo=timezone.utc``. This applies to anything using
    ``http.parse_date``: ````, ``.if_modified_since``,
    ``.if_unmodified_since``; ````, ``.expires``,
    ``.last_modified``, ``.retry_after``; ``parse_if_range_header``, and
    ````. When comparing values, the other values must also
    be aware, or these values must be made naive. When passing
    parameters or setting attributes, naive values are still assumed to
    be in UTC. :pr:`2040`
-   Merge all request and response wrapper mixin code into single
    ``Request`` and ``Response`` classes. Using the mixin classes is no
    longer necessary and will show a deprecation warning. Checking
    ``isinstance`` or ``issubclass`` against ``BaseRequest`` and
    ``BaseResponse`` will show a deprecation warning and check against
    ``Request`` or ``Response`` instead. :issue:`1963`
-   JSON support no longer uses simplejson if it's installed. To use
    another JSON module, override ``Request.json_module`` and
    ``Response.json_module``. :pr:`1766`
-   ``Response.get_json()`` no longer caches the result, and the
    ``cache`` parameter is removed. :issue:`1698`
-   ``Response.freeze()`` generates an ``ETag`` header if one is not
    set. The ``no_etag`` parameter (which usually wasn't visible
    anyway) is no longer used. :issue:`1963`
-   Add a ``url_scheme`` argument to :meth:``
    to override the bound scheme. :pr:`1721`
-   Passing an empty list as a query string parameter to ``build()``
    won't append an unnecessary ``?``. Also drop any number of ``None``
    items in a list. :issue:`1992`
-   When passing a ``Headers`` object to a test client method or
    ``EnvironBuilder``, multiple values for a key are joined into one
    comma separated value. This matches the HTTP spec on multi-value
    headers. :issue:`1655`
-   Setting ``Response.status`` and ``status_code`` uses identical
    parsing and error checking. :issue:`1658`, :pr:`1728`
-   ``MethodNotAllowed`` and ``RequestedRangeNotSatisfiable`` take a
    ``response`` kwarg, consistent with other HTTP errors. :pr:`1748`
-   The response generated by :exc:`~exceptions.Unauthorized` produces
    one ``WWW-Authenticate`` header per value in ``www_authenticate``,
    rather than joining them into a single value, to improve
    interoperability with browsers and other clients. :pr:`1755`
-   If ``parse_authorization_header`` can't decode the header value, it
    returns ``None`` instead of raising a ``UnicodeDecodeError``.
-   The debugger no longer uses jQuery. :issue:`1807`
-   The test client includes the query string in ``REQUEST_URI`` and
    ``RAW_URI``. :issue:`1781`
-   Switch the parameter order of ``default_stream_factory`` to match
    the order used when calling it. :pr:`1085`
-   Add ``send_file`` function to generate a response that serves a
    file. Adapted from Flask's implementation. :issue:`265`, :pr:`1850`
-   Add ``send_from_directory`` function to safely serve an untrusted
    path within a trusted directory. Adapted from Flask's
    implementation. :issue:`1880`
-   ``send_file`` takes ``download_name``, which is passed even if
    ``as_attachment=False`` by using ``Content-Disposition: inline``.
    ``download_name`` replaces Flask's ``attachment_filename``.
-   ``send_file`` sets ``conditional=True`` and ``max_age=None`` by
    default. ``Cache-Control`` is set to ``no-cache`` if ``max_age`` is
    not set, otherwise ``public``. This tells browsers to validate
    conditional requests instead of using a timed cache.
    ``max_age=None`` replaces Flask's ``cache_timeout=43200``.
-   ``send_file`` can be called with ``etag="string"`` to set a custom
    ETag instead of generating one. ``etag`` replaces Flask's
    ``add_etags``. :issue:`1868`
-   ``send_file`` sets the ``Content-Encoding`` header if an encoding is
    returned when guessing ``mimetype`` from ``download_name``.
-   Update the defaults used by ``generate_password_hash``. Increase
    PBKDF2 iterations to 260000 from 150000. Increase salt length to 16
    from 8. Use ``secrets`` module to generate salt. :pr:`1935`
-   The reloader doesn't crash if ``sys.stdin`` is somehow ``None``.
-   Add arguments to ``delete_cookie`` to match ``set_cookie`` and the
    attributes modern browsers expect. :pr:`1889`
-   ``utils.cookie_date`` is deprecated, use ``utils.http_date``
    instead. The value for ``Set-Cookie expires`` is no longer "-"
    delimited. :pr:`2040`
-   Use ``request.headers`` instead of ``request.environ`` to look up
    header attributes. :pr:`1808`
-   The test ``Client`` request methods (``client.get``, etc.) always
    return an instance of ``TestResponse``. In addition to the normal
    behavior of ``Response``, this class provides ``request`` with the
    request that produced the response, and ``history`` to track
    intermediate responses when ``follow_redirects`` is used.
    :issue:`763, 1894`
-   The test ``Client`` request methods takes an ``auth`` parameter to
    add an ``Authorization`` header. It can be an ``Authorization``
    object or a ``(username, password)`` tuple for ``Basic`` auth.
-   Calling ``response.close()`` on a response from the test ``Client``
    will close the request input stream. This matches file behavior
    and can prevent a ``ResourceWarning`` in some cases. :issue:`1785`
-   ``EnvironBuilder.from_environ`` decodes values encoded for WSGI, to
    avoid double encoding the new values. :pr:`1959`
-   The default stat reloader will watch Python files under
    non-system/virtualenv ``sys.path`` entries, which should contain
    most user code. It will also watch all Python files under
    directories given in ``extra_files``. :pr:`1945`
-   The reloader ignores ``__pycache__`` directories again. :pr:`1945`
-   ``run_simple`` takes ``exclude_patterns`` a list of ``fnmatch``
    patterns that will not be scanned by the reloader. :issue:`1333`
-   Cookie names are no longer unquoted. This was against :rfc:`6265`
    and potentially allowed setting ``__Secure`` prefixed cookies.
-   Fix some word matches for user agent platform when the word can be a
    substring. :issue:`1923`
-   The development server logs ignored SSL errors. :pr:`1967`
-   Temporary files for form data are opened in ``rb+`` instead of
    ``wb+`` mode for better compatibility with some libraries.
-   Use SHA-1 instead of MD5 for generating ETags and the debugger pin,
    and in some tests. MD5 is not available in some environments, such
    as FIPS 140. This may invalidate some caches since the ETag will be
    different. :issue:`1897`
-   Add ``Cross-Origin-Opener-Policy`` and
    ``Cross-Origin-Embedder-Policy`` response header properties.
-   ``run_simple`` tries to show a valid IP address when binding to all
    addresses, instead of ```` or ``::``. It also warns about not
    running the development server in production in this case.
-   Colors in the development server log are displayed if Colorama is
    installed on Windows. For all platforms, style support no longer
    requires Click. :issue:`1832`
-   A range request for an empty file (or other data with length 0) will
    return a 200 response with the empty file instead of a 416 error.
-   New sans-IO base classes for ``Request`` and ``Response`` have been
    extracted to contain all the behavior that is not WSGI or IO
    dependent. These are not a public API, they are part of an ongoing
    refactor to let ASGI frameworks use Werkzeug. :pr:`2005`
-   Parsing ``multipart/form-data`` has been refactored to use sans-io
    patterns. This should also make parsing forms with large binary file
    uploads significantly faster. :issue:`1788, 875`
-   ``LocalProxy`` matches the current Python data model special
    methods, including all r-ops, in-place ops, and async. ``__class__``
    is proxied, so the proxy will look like the object in more cases,
    including ``isinstance``. Use ``issubclass(type(obj), LocalProxy)``
    to check if an object is actually a proxy. :issue:`1754`
-   ``Local`` uses ``ContextVar`` on Python 3.7+ instead of
    ``threading.local``. :pr:`1778`
-   ``request.values`` does not include ``form`` for GET requests (even
    though GET bodies are undefined). This prevents bad caching proxies
    from caching form data instead of query strings. :pr:`2037`
-   The development server adds the underlying socket to ``environ`` as
    ``werkzeug.socket``. This is non-standard and specific to the dev
    server, other servers may expose this under their own key. It is
    useful for handling a WebSocket upgrade request. :issue:`2052`
-   URL matching assumes ``websocket=True`` mode for WebSocket upgrade
    requests. :issue:`2052`
-   Updated ``UserAgentParser`` to handle more cases. :issue:`1971`
-   ``werzeug.DechunkedInput.readinto`` will not read beyond the size of
    the buffer. :issue:`2021`
-   Fix connection reset when exceeding max content size. :pr:`2051`
-   ``pbkdf2_hex``, ``pbkdf2_bin``, and ``safe_str_cmp`` are deprecated.
    ``hashlib`` and ``hmac`` provide equivalents. :pr:`2083`
-   ``invalidate_cached_property`` is deprecated. Use ``del``
    instead. :pr:`2084`
-   ``Href`` is deprecated. Use ``werkzeug.routing`` instead.
-   ``Request.disable_data_descriptor`` is deprecated. Create the
    request with ``shallow=True`` instead. :pr:`2085`
-   ``HTTPException.wrap`` is deprecated. Create a subclass manually
    instead. :pr:`2085`