# What changed in flask-wtf

> 9 changes in flask-wtf 1 from its official release notes, upgrade guides and advisories: 1 breaking, 5 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/pypi/flask-wtf/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## flask-wtf 1

### Breaking changes

- Deprecated items were removed. (1.0.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.0.0)

### New APIs and options

- A helper for adding CSRF meta tags is available. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)
- The RECAPTCHA_ENABLE setting can disable reCAPTCHA. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)
- reCaptcha now allows a nonce. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)
- Widgets support kwargs for adding custom HTML attributes. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)
- Support was added for alternative captcha services. (1.0.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.0.0)

### Performance

- Flask-WTF tries not to read uploaded files into memory. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)

### Fixes and other changes

- CSRFProtect.protect() now respects exemptions. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)
- Flask-WTF adds support for Python 3.14. (1.3.0) — [release notes](https://github.com/pallets-eco/flask-wtf/releases/tag/v1.3.0)