Fix signing key selection order when key rotation is enabled via
SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
Fix type hint for cli_runner.invoke. :issue:5645
flask --help loads the app and plugins first to make sure all commands
are shown. :issue:5673
Mark sans-io base class as being able to handle views that return
AsyncIterable. This is not accurate for Flask, but makes typing easier
for Quart. 5659
Provide a configuration option to control automatic option
responses. 5496
Flask.open_resource/open_instance_resource and
Blueprint.open_resource take an encoding parameter to use when
opening in text mode. It defaults to utf-8. :issue:5504
Request.max_content_length can be customized per-request instead of only
through the MAX_CONTENT_LENGTH config. Added
MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation
about resource limits to the security page. :issue:5625
Add support for the Partitioned cookie attribute (CHIPS), with the
SESSION_COOKIE_PARTITIONED config. :issue:5472
-e path takes precedence over default .env and .flaskenv files.
load_dotenv loads default files in addition to a path unless
load_defaults=False is passed. :issue:5628
Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
secret keys that can still be used for unsigning. Extensions will need to
add support. :issue:5621
Fix how setting host_matching=True or subdomain_matching=False
interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts
requests to only that domain. :issue:5553
Request.trusted_hosts is checked during routing, and can be set through
the TRUSTED_HOSTS config. :issue:5636
Configuration
Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
Automerge: Disabled by config. Please merge this manually once you are satisfied.
Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.
Ignore: Close this MR and you won't be reminded about this update again.
If you want to rebase/retry this MR, check this box
