Sync changes to SLFO-1.2 branch

- Update to 3.1.0:
  * Drop support for Python 3.8.
  * Update minimum dependency versions to latest feature releases.
    Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.
  * Provide a configuration option to control automatic option responses.
  * Flask.open_resource/open_instance_resource and Blueprint.open_resource
    take an encoding parameter to use when opening in text mode. It defaults
    to utf-8.
  * Request.max_content_length can be customized per-request instead of only
    through the MAX_CONTENT_LENGTH config.
  * Add support for the Partitioned cookie attribute (CHIPS), with the
    SESSION_COOKIE_PARTITIONED config.
  * -e path takes precedence over default .env and .flaskenv files.
    load_dotenv loads default files in addition to a path unless
    load_defaults=False is passed.
  * Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
    secret keys that can still be used for unsigning.
  * Fix how setting host_matching=True or subdomain_matching=False interacts
    with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to
    only that domain.
  * Request.trusted_hosts is checked during routing, and can be set through
    the TRUSTED_HOSTS config.

OBS-URL: https://build.opensuse.org/request/show/1244038
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Flask?expand=0&rev=42

python-Flask.changes

@@ -1,3 +1,42 @@
+-------------------------------------------------------------------
+Thu May 15 06:16:18 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Update to 3.1.1 (CVE-2025-47278, bsc#1243163):
+  * Fix signing key selection order when key rotation is enabled via
+    SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
+  * Fix type hint for cli_runner.invoke. #5645
+  * flask --help loads the app and plugins first to make sure all
+    commands are shown. #5673
+  * Mark sans-io base class as being able to handle views that return
+    AsyncIterable. This is not accurate for Flask, but makes typing
+    easier for Quart. #5659
+
+-------------------------------------------------------------------
+Fri Feb  7 01:47:56 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Update to 3.1.0:
+  * Drop support for Python 3.8.
+  * Update minimum dependency versions to latest feature releases.
+    Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9.
+  * Provide a configuration option to control automatic option responses.
+  * Flask.open_resource/open_instance_resource and Blueprint.open_resource
+    take an encoding parameter to use when opening in text mode. It defaults
+    to utf-8.
+  * Request.max_content_length can be customized per-request instead of only
+    through the MAX_CONTENT_LENGTH config.
+  * Add support for the Partitioned cookie attribute (CHIPS), with the
+    SESSION_COOKIE_PARTITIONED config.
+  * -e path takes precedence over default .env and .flaskenv files.
+    load_dotenv loads default files in addition to a path unless
+    load_defaults=False is passed.
+  * Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
+    secret keys that can still be used for unsigning.
+  * Fix how setting host_matching=True or subdomain_matching=False interacts
+    with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to
+    only that domain.
+  * Request.trusted_hosts is checked during routing, and can be set through
+    the TRUSTED_HOSTS config.
+
 -------------------------------------------------------------------
 Tue Aug 13 17:07:09 UTC 2024 - Guang Yee <gyee@suse.com>
 

python-Flask.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-Flask
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -24,7 +24,7 @@
 
 %{?sle15_python_module_pythons}
 Name:           python-Flask
-Version:        3.0.3
+Version:        3.1.1
 Release:        0
 Summary:        A microframework based on Werkzeug, Jinja2 and good intentions
 License:        BSD-3-Clause
@@ -32,22 +32,25 @@ URL:            https://flask.palletsprojects.com
 Source0:        https://files.pythonhosted.org/packages/source/f/flask/flask-%{version}.tar.gz
 Source1:        python-Flask-rpmlintrc
 BuildRequires:  %{python_module Jinja2 >= 3.1.2}
-BuildRequires:  %{python_module Werkzeug >= 3.0.0}
-BuildRequires:  %{python_module blinker >= 1.6.2}
+BuildRequires:  %{python_module MarkupSafe}
+BuildRequires:  %{python_module Werkzeug >= 3.1.0}
+BuildRequires:  %{python_module base >= 3.9}
+BuildRequires:  %{python_module blinker >= 1.9}
 BuildRequires:  %{python_module click >= 8.1.3}
 BuildRequires:  %{python_module flit-core}
 BuildRequires:  %{python_module importlib-metadata >= 3.6.0 if %python-base < 3.10}
-BuildRequires:  %{python_module itsdangerous >= 2.1.2}
+BuildRequires:  %{python_module itsdangerous >= 2.2}
 BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module pytest >= 6.2.4}
 BuildRequires:  %{python_module wheel}
 BuildRequires:  fdupes
 BuildRequires:  python-rpm-macros >= 20210929
 Requires:       python-Jinja2 >= 3.1.2
-Requires:       python-Werkzeug >= 3.0.0
-Requires:       python-blinker >= 1.6.2
+Requires:       python-MarkupSafe
+Requires:       python-Werkzeug >= 3.1.0
+Requires:       python-blinker >= 1.9
 Requires:       python-click >= 8.1.3
-Requires:       python-itsdangerous >= 2.1.2
+Requires:       python-itsdangerous >= 2.2
 %if 0%{?python_version_nodots} < 310
 Requires:       python-importlib-metadata >= 3.6.0
 %endif