pypi / werkzeug

werkzeug

What changed in werkzeug 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

4 breaking3 performance2 behavior and defaults16 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

werkzeug 325 changes

Basic auth parsing disallows non-base64 characters.
3.1.9release notes
The URL converter returns a 404 instead of a 500 error when the value exceeds sys.get_int_max_str_digits().
3.1.9release notes
On Windows, safe_join no longer allows special device names with empty ADS markers on NTFS.
3.1.9release notes
Request.host, get_host, and host_is_trusted validate value characters; empty values are disallowed and Unix socket server addresses are ignored.
3.1.7release notes

Form data is no longer limited by max_form_memory_size, only by max_content_length.
3.1.9release notes
Sets the Accept-Ranges header even when the range request is not satisfiable.
3.1.7release notes

PIN generation from cgroup data inside Podman is improved.
3.1.9release notes
Also checks that the port is in the valid range.
3.1.9release notes
Preserves empty usernames and passwords, and port 0.
3.1.9release notes
Does not resize the buffer when it reads less than the remaining size.
3.1.9release notes
Uses profiling.tracing on Python 3.15.
3.1.9release notes
The invalid suffix length -0 is no longer accepted.
3.1.9release notes
Preserves empty usernames and passwords, and port 0.
3.1.9release notes
Rules with 10 or more converters in a single part assign matched values correctly.
3.1.9release notes
Returns the empty string if the header is missing or has invalid characters.
3.1.8release notes
Returns the empty string if the header is missing or has invalid characters.
3.1.8release notes
The trusted_list argument is optional.
3.1.7release notes
Merges any number of consecutive slashes.
3.1.7release notes
Fixes handling of a newline at a multipart boundary.
3.1.7release notes
Preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values.
3.1.7release notes
Is parsed as a set.
3.1.7release notes
Does not produce a trailing space when there are no parameters.
3.1.7release notes