← All reportsPublic report

pallets/flask

The Python micro framework for building web applications.

72k stars Python View on GitHubprofiled 11d ago
Try GitZoid
16PRs this week
3Contributors
84Deps scanned
1Issues found
01 · Repo overview

How flask is put together

Flask is a lightweight WSGI web application framework for Python, built as a thin, opinionated layer over Werkzeug (WSGI/routing/wrappers) and Jinja (templating). The core Flask object acts as the central WSGI application and registry for view functions, URL rules, config, and template configuration, with a sans-io base layer (src/flask/sansio) separating framework logic from the WSGI-specific request/response handling. Request data flows in via Werkzeug wrappers, is dispatched through the URL map to view functions, and returns responses; session state is carried in signed cookies via itsdangerous. It is packaged as a typed library distributed on PyPI, exposing a CLI (flask) built on Click.

Languages

Python

Frameworks

FlaskWerkzeugJinja2Click

Infrastructure

GitHub ActionsRead the DocsDev Containerstoxpre-commit

Major components

Core application (app.py / sansio/app.py)

Implements the central Flask/App WSGI object holding config, URL map, view registry, and request dispatch.

Sans-io base layer (sansio/)

Provides framework logic (app, blueprints, scaffold) decoupled from the actual WSGI request/response objects.

Sessions (sessions.py)

Implements signed secure-cookie session backends and the pluggable SessionInterface.

Request/response wrappers (wrappers.py)

Subclasses Werkzeug Request/Response to add Flask-specific routing, JSON, and content-length behaviors.

Configuration (config.py)

Loads app config from files, objects, and prefixed environment variables into a dict-based Config.

CLI (cli.py)

Provides the `flask` command-line interface built on Click, including the dev server runner.

JSON handling (json/)

Supplies JSON providers and tagged JSON serialization used for responses and session encoding.

Context & globals (ctx.py, globals.py)

Manages application/request context stacks and proxies like current_app, request, session, and g.

Over the past few weeks the Flask team focused on fixing how the framework handles modern network addresses (IPv6) and adding support for newer web standards. The headline addition is a new `app.query` shortcut that lets developers handle the emerging HTTP QUERY method, alongside steady maintenance like testing against upcoming Python versions, updating dependencies, and cleaning up documentation.

Week by week

2026-08-10Added a new `app.query` route shortcut for the HTTP QUERY method while fixing IPv6 address handling and tidying docs.latest4 changes

Feature

New `app.query` route decorator

Developers can now easily handle the emerging HTTP QUERY method, both as a route shortcut and in class-based views.

Fix

Correct handling of IPv6 addresses

Fixed address parsing so servers running on IPv6 addresses with ports are no longer misread.

Docs

Clearer file-sending instructions

Improved wording in the documentation explaining how to send file-like objects, plus general typo cleanups.

Refactor

Use header properties

Adjusted internal code to rely on standard header properties for cleaner request handling.

2026-07-27Routine maintenance: prepared for a future Python version, refreshed dependencies, and modernized test code.3 changes

Chore

Test against Python 3.15

Added testing for the upcoming Python 3.15 release to stay ahead of compatibility issues.

Chore

Update dependencies

Refreshed the project's supporting libraries to current versions.

Chore

Replace private testing API usage

Swapped out an internal, unsupported testing helper for a stable public equivalent.

2026-07-13Fixed several IPv6-related bugs in server naming and session handling.3 changes

Fix

Fix IPv6 server name parsing

Corrected how the framework reads IPv6 server names so they are no longer split incorrectly.

Fix

Fix IPv6 session transactions

Resolved a problem where user sessions failed on servers using IPv6 addresses.

Chore

Replace private testing API usage

Began moving test code off an internal, unsupported helper to a stable public one.

03 · Security check

Dependencies and code review

84 dependencies scanned

Dependency advisories

Security Watch

1 vulnerable package (1 advisories) across 84 scanned dependencies.

warninghigh · pypifixed in 50.0.0

cryptography 49.0.0

1 advisory. Fixed in 50.0.0.

  • highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required