pallets/flask
The Python micro framework for building web applications.
How flask is put together
Flask is a lightweight WSGI web application framework for Python, built as a thin, opinionated layer over Werkzeug (WSGI/routing/wrappers) and Jinja (templating). The core Flask object acts as the central WSGI application and registry for view functions, URL rules, config, and template configuration, with a sans-io base layer (src/flask/sansio) separating framework logic from the WSGI-specific request/response handling. Request data flows in via Werkzeug wrappers, is dispatched through the URL map to view functions, and returns responses; session state is carried in signed cookies via itsdangerous. It is packaged as a typed library distributed on PyPI, exposing a CLI (flask) built on Click.
Languages
Frameworks
Infrastructure
Major components
Core application (app.py / sansio/app.py)
Implements the central Flask/App WSGI object holding config, URL map, view registry, and request dispatch.
Sans-io base layer (sansio/)
Provides framework logic (app, blueprints, scaffold) decoupled from the actual WSGI request/response objects.
Sessions (sessions.py)
Implements signed secure-cookie session backends and the pluggable SessionInterface.
Request/response wrappers (wrappers.py)
Subclasses Werkzeug Request/Response to add Flask-specific routing, JSON, and content-length behaviors.
Configuration (config.py)
Loads app config from files, objects, and prefixed environment variables into a dict-based Config.
CLI (cli.py)
Provides the `flask` command-line interface built on Click, including the dev server runner.
JSON handling (json/)
Supplies JSON providers and tagged JSON serialization used for responses and session encoding.
Context & globals (ctx.py, globals.py)
Manages application/request context stacks and proxies like current_app, request, session, and g.
Added a new `app.query` route shortcut for the HTTP QUERY method while fixing IPv6 address handling and tidying docs.
3 weeksWeek of 2026-08-10
Week of 2026-08-10latest
Added a new `app.query` route shortcut for the HTTP QUERY method while fixing IPv6 address handling and tidying docs.
Week of 2026-07-27
Routine maintenance: prepared for a future Python version, refreshed dependencies, and modernized test code.
Week of 2026-07-13
Fixed several IPv6-related bugs in server naming and session handling.
Over the past few weeks the Flask team focused on fixing how the framework handles modern network addresses (IPv6) and adding support for newer web standards. The headline addition is a new `app.query` shortcut that lets developers handle the emerging HTTP QUERY method, alongside steady maintenance like testing against upcoming Python versions, updating dependencies, and cleaning up documentation.
Week by week
2026-08-10Added a new `app.query` route shortcut for the HTTP QUERY method while fixing IPv6 address handling and tidying docs.latest4 changes
Feature
New `app.query` route decorator
Developers can now easily handle the emerging HTTP QUERY method, both as a route shortcut and in class-based views.
Fix
Correct handling of IPv6 addresses
Fixed address parsing so servers running on IPv6 addresses with ports are no longer misread.
Docs
Clearer file-sending instructions
Improved wording in the documentation explaining how to send file-like objects, plus general typo cleanups.
Refactor
Use header properties
Adjusted internal code to rely on standard header properties for cleaner request handling.
2026-07-27Routine maintenance: prepared for a future Python version, refreshed dependencies, and modernized test code.3 changes
Chore
Test against Python 3.15
Added testing for the upcoming Python 3.15 release to stay ahead of compatibility issues.
Chore
Update dependencies
Refreshed the project's supporting libraries to current versions.
Chore
Replace private testing API usage
Swapped out an internal, unsupported testing helper for a stable public equivalent.
2026-07-13Fixed several IPv6-related bugs in server naming and session handling.3 changes
Fix
Fix IPv6 server name parsing
Corrected how the framework reads IPv6 server names so they are no longer split incorrectly.
Fix
Fix IPv6 session transactions
Resolved a problem where user sessions failed on servers using IPv6 addresses.
Chore
Replace private testing API usage
Began moving test code off an internal, unsupported helper to a stable public one.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (1 advisories) across 84 scanned dependencies.
cryptography 49.0.0
1 advisory. Fixed in 50.0.0.
- highGHSA-g6cj-pr64-35w5cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required