TL;DR

Flask now correctly handles session access checks, resolving a potential security vulnerability when only session keys are inspected.

Fixes Worth Knowing

Session access is now accurately tracked even when only keys (data names) are checked, preventing potential security issues.

TL;DR

Flask now correctly handles URL schemes like javascript: and data: preventing potential security vulnerabilities and unexpected behavior.

Fixes Worth Knowing

Resolved a security issue where Flask would execute arbitrary JavaScript code via crafted URLs. This update prevents execution of non-HTTP/HTTPS schemes, improving application security (web application framework).

Before You Upgrade

No specific action is needed, but review your application’s URL handling to ensure it doesn’t rely on unsupported schemes.

TL;DR

Flask 2.0 introduces significant changes under the hood, requiring users to explicitly specify the url_for endpoint when using blueprints to avoid ambiguity and improve application clarity.

Breaking

• url_for with blueprint names now required (prevents unexpected routing).

New

• Werkzeug 2.0 (WSGI utility library) is now required, offering performance improvements and security fixes.
• ASGI support (asynchronous web framework) is improved, enabling more concurrent connections.

Fixes Worth Knowing

• Session handling is more robust, addressing potential issues with concurrent requests.

Before You Upgrade

• Update your url_for calls to include the blueprint name where applicable.
• Ensure your dependencies include Werkzeug 2.0 or later.

TL;DR

Flask no longer supports older Python versions, and developers should address deprecation warnings to prepare for Flask 2.0.

Breaking

• Python 2.7 and 3.5 support dropped (older Python versions)
• Deprecations will become removals (future compatibility)

Fixes Worth Knowing

No user-facing fixes were included in this release.

Before You Upgrade

Ensure your project is running a supported Python version (3.6+) and address any deprecation warnings displayed by your application.

TL;DR

Flask now strictly enforces UTF-8 encoding for incoming JSON, improving security and preventing potential denial-of-service attacks.

Breaking

• JSON decoding now requires UTF-8 encoding (prevents arbitrary encoding use).

New

(None - security fix is the primary change)

Fixes Worth Knowing

• Improved CLI support within PyCharm.

Before You Upgrade

Ensure your applications send JSON data encoded as UTF-8 to avoid compatibility issues.