Werkzeug is a comprehensive Python WSGI web application library, providing utilities for building and testing web apps. It includes tools for requests and responses, routing and URL generation, HTTP helpers, a development WSGI server, and an interactive debugger.
Project status
- Actively maintained: The repo shows very recent activity (latest upstream push 2026-09-27), and Werkzeug has published a security focused update sequence in 2026, including 3.1.9 on 2026-09-27.
- Apparent update cadence: After 3.1.4 (2025-11-29), there were updates in early 2026 (3.1.5 on 2026-01-08, 3.1.6 on 2026-02-19, 3.1.7 on 2026-03-24), then a longer gap to 3.1.8 (2026-04-02), and another longer gap to 3.1.9 (2026-09-27).
AI summary generated
Recent updates
3.1.9
Werkzeug 3.1.9 is presented as a security fix release that also includes multiple parsing performance improvements. The release notes list specific correctness and security items around safe path joining, auth header parsing, request size limits, URL conversion errors, and several HTTP parsing and routing fixes.
Security3.1.8
Werkzeug 3.1.8 is a fix release that primarily changes host handling behavior in Request.host and get_host when the Host header is missing or contains invalid characters. The code diff is small, focused on src/werkzeug/sansio/utils.py plus corresponding test and documentation updates.
3.1.7
Werkzeug 3.1.7 is a bugfix release that focuses on HTTP parsing correctness (list/dict header parsing, Transfer-Encoding parsing), request host validation, multipart boundary handling, conditional range headers, and improved slash-merging behavior. The release notes describe the user-visible fixes, and the code largely matches those points.
3.1.6
Werkzeug 3.1.6 is a security release. The documented change hardens `safe_join` on Windows to reject special device names when they appear in multi-segment (slash-containing) untrusted paths. The code diff also shows additional security-related internal adjustments beyond what is stated in the release notes.
Security3.1.5
Werkzeug 3.1.5 is a security and bug fix release. It primarily tightens Windows path handling in `safe_join`, improves multipart form parsing across chunk boundaries, and fixes an `AttributeError` when constructing `DebuggedApplication` with `pin_security=False`.
BreakingSecurity3.1.4
Werkzeug 3.1.4 is a patch release focused on bug fixes, including safer path joining on Windows, improved multipart parsing at chunk boundaries, and debugger/traceback fixes. The release notes claim no other behavior changes beyond these items.
Security3.1.3
Werkzeug 3.1.3 is a bug fix release. The main documented changes are stricter handling of “multi value” inputs to MultiDict and similar data structures, and correct bracket-wrapping of IPv6 SERVER_NAME values when falling back for Request.host.
3.1.2
Werkzeug 3.1.2 is a fix release focused on improving type hints with minimal to no intended runtime behavior changes from 3.1.0. The release notes specifically call out updated typing for the `type` conversion callable and correcting the `Headers` class hierarchy.
Breaking3.1.1
Werkzeug 3.1.1 is a small maintenance release that primarily fixes a bug where `str(Request.headers)` incorrectly appeared empty. The code change is localized to header string rendering, along with a new regression test and a version bump.
3.1.0
Werkzeug 3.1.0 is a feature release that includes several deprecations and potentially breaking behavior changes, especially around request form size limits and cache-control directive parsing/typing. It also updates security posture by increasing PBKDF2 work factor, and modernizes the datastructures API surface with operator support and inlined typing.
BreakingSecurityFeatures3.0.6
Werkzeug 3.0.6 is a security-focused release that addresses two issues: multipart form parsing memory-limit enforcement for non-file fields, and improved path validation in `safe_join`. The changes are intended to fix security vulnerabilities without otherwise changing behavior.
Security