Initial Update

[pyup-bot]

This is my first visit to this fine repo so I have bundled all updates in a single pull request to make things easier for you to merge.

Close this pull request and delete the branch if you want me to start with single pull requests right away

Here's the executive summary:

Updates

Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need.

Flask	0.10.1	»	0.12.2	PyPI | Changelog | Repo
gunicorn	19.3.0	»	19.7.1	PyPI | Changelog | Homepage
Jinja2	2.7.3	»	2.10	PyPI | Homepage
MarkupSafe	0.23	»	1.0	PyPI | Changelog | Repo
Werkzeug	0.10.4	»	0.14.1	PyPI | Changelog | Homepage

Changelogs

Flask 0.10.1 -> 0.12.2

0.12.2

---

Released on May 16 2017

• Fix a bug in safe_join on Windows.

0.12.1

---

Bugfix release, released on March 31st 2017

• Prevent flask run from showing a NoAppException when an ImportError occurs
  within the imported application module.
• Fix encoding behavior of app.config.from_pyfile for Python 3. Fix
  2118.
• Use the SERVER_NAME config if it is present as default values for
  app.run. 2109, 2152
• Call ctx.auto_pop with the exception object instead of None, in the
  event that a BaseException such as KeyboardInterrupt is raised in a
  request handler.

0.12

---

Released on December 21st 2016, codename Punsch.

• the cli command now responds to --version.
• Mimetype guessing and ETag generation for file-like objects in send_file
  has been removed, as per issue 104. See pull request 1849.
• Mimetype guessing in send_file now fails loudly and doesn't fall back to
  application/octet-stream. See pull request 1988.
• Make flask.safe_join able to join multiple paths like os.path.join
  (pull request 1730).
• Revert a behavior change that made the dev server crash instead of returning
  a Internal Server Error (pull request 2006).
• Correctly invoke response handlers for both regular request dispatching as
  well as error handlers.
• Disable logger propagation by default for the app logger.
• Add support for range requests in send_file.
• app.test_client includes preset default environment, which can now be
  directly set, instead of per client.get.

0.11.2

---

Bugfix release, unreleased

• Fix crash when running under PyPy3, see pull request 1814.

0.11.1

---

Bugfix release, released on June 7th 2016.

• Fixed a bug that prevented FLASK_APP=foobar/__init__.py from working. See
  pull request 1872.

0.11

---

Released on May 29th 2016, codename Absinthe.

• Added support to serializing top-level arrays to :func:flask.jsonify. This
  introduces a security risk in ancient browsers. See
  :ref:json-security for details.
• Added before_render_template signal.
• Added **kwargs to :meth:flask.Test.test_client to support passing
  additional keyword arguments to the constructor of
  :attr:flask.Flask.test_client_class.
• Added SESSION_REFRESH_EACH_REQUEST config key that controls the
  set-cookie behavior. If set to True a permanent session will be
  refreshed each request and get their lifetime extended, if set to
  False it will only be modified if the session actually modifies.
  Non permanent sessions are not affected by this and will always
  expire if the browser window closes.
• Made Flask support custom JSON mimetypes for incoming data.
• Added support for returning tuples in the form (response, headers)
  from a view function.
• Added :meth:flask.Config.from_json.
• Added :attr:flask.Flask.config_class.
• Added :meth:flask.Config.get_namespace.
• Templates are no longer automatically reloaded outside of debug mode. This
  can be configured with the new TEMPLATES_AUTO_RELOAD config key.
• Added a workaround for a limitation in Python 3.3's namespace loader.
• Added support for explicit root paths when using Python 3.3's namespace
  packages.
• Added :command:flask and the flask.cli module to start the local
  debug server through the click CLI system. This is recommended over the old
  flask.run() method as it works faster and more reliable due to a
  different design and also replaces Flask-Script.
• Error handlers that match specific classes are now checked first,
  thereby allowing catching exceptions that are subclasses of HTTP
  exceptions (in werkzeug.exceptions). This makes it possible
  for an extension author to create exceptions that will by default
  result in the HTTP error of their choosing, but may be caught with
  a custom error handler if desired.
• Added :meth:flask.Config.from_mapping.
• Flask will now log by default even if debug is disabled. The log format is
  now hardcoded but the default log handling can be disabled through the
  LOGGER_HANDLER_POLICY configuration key.
• Removed deprecated module functionality.
• Added the EXPLAIN_TEMPLATE_LOADING config flag which when enabled will
  instruct Flask to explain how it locates templates. This should help
  users debug when the wrong templates are loaded.
• Enforce blueprint handling in the order they were registered for template
  loading.
• Ported test suite to py.test.
• Deprecated request.json in favour of request.get_json().
• Add "pretty" and "compressed" separators definitions in jsonify() method.
  Reduces JSON response size when JSONIFY_PRETTYPRINT_REGULAR=False by removing
  unnecessary white space included by default after separators.
• JSON responses are now terminated with a newline character, because it is a
  convention that UNIX text files end with a newline and some clients don't
  deal well when this newline is missing. See
  Add JSONIFY_END_WITH_NEWLINE config variable pallets/flask#1262 -- this came up originally as a
  part of https://github.com/kennethreitz/httpbin/issues/168
• The automatically provided OPTIONS method is now correctly disabled if
  the user registered an overriding rule with the lowercase-version
  options (issue 1288).
• flask.json.jsonify now supports the datetime.date type (pull request
  1326).
• Don't leak exception info of already catched exceptions to context teardown
  handlers (pull request 1393).
• Allow custom Jinja environment subclasses (pull request 1422).
• flask.g now has pop() and setdefault methods.
• Turn on autoescape for flask.templating.render_template_string by default
  (pull request 1515).
• flask.ext is now deprecated (pull request 1484).
• send_from_directory now raises BadRequest if the filename is invalid on
  the server OS (pull request 1763).
• Added the JSONIFY_MIMETYPE configuration variable (pull request 1728).
• Exceptions during teardown handling will no longer leave bad application
  contexts lingering around.

0.10.2

---

(bugfix release, release date to be announced)

• Fixed broken test_appcontext_signals() test case.
• Raise an :exc:AttributeError in :func:flask.helpers.find_package with a
  useful message explaining why it is raised when a PEP 302 import hook is used
  without an is_package() method.
• Fixed an issue causing exceptions raised before entering a request or app
  context to be passed to teardown handlers.
• Fixed an issue with query parameters getting removed from requests in
  the test client when absolute URLs were requested.
• Made before_first_request into a decorator as intended.
• Fixed an etags bug when sending a file streams with a name.
• Fixed send_from_directory not expanding to the application root path
  correctly.
• Changed logic of before first request handlers to flip the flag after
  invoking. This will allow some uses that are potentially dangerous but
  should probably be permitted.
• Fixed Python 3 bug when a handler from app.url_build_error_handlers
  reraises the BuildError.

gunicorn 19.3.0 -> 19.7.1

19.7.1

===================

• fix: continue if SO_REUSEPORT seems to be available but fails (:issue:1480)
• fix: support non-decimal values for the umask command line option (:issue:1325)

19.7.0

===================

• The previously deprecated gunicorn_django command has been removed.
  Use the :ref:gunicorn-cmd command-line interface instead.
• The previously deprecated django_settings setting has been removed.
  Use the :ref:raw-env setting instead.
• The default value of :ref:ssl-version has been changed from
  ssl.PROTOCOL_TLSv1 to ssl.PROTOCOL_SSLv23.
• fix: initialize the group access list when initgroups is set (:issue:1297)
• add environment variables to gunicorn access log format (:issue:1291)
• add --paste-global-conf option (:issue:1304)
• fix: print access logs to STDOUT (:issue:1184)
• remove upper limit on max header size config (:issue:1313)
• fix: print original exception on AppImportError (:issue:1334)
• use SO_REUSEPORT if available (:issue:1344)
• fix leak <https://github.com/benoitc/gunicorn/commit/b4c41481e2d5ef127199a4601417a6819053c3fd>_ of duplicate file descriptor for bound sockets.
• add --reload-engine option, support inotify and other backends (:issue:1368, :issue:1459)
• fix: reject request with invalid HTTP versions
• add child_exit callback (:issue:1394)
• add support for eventlets _AlreadyHandled object (:issue:1406)
• format boot tracebacks properly with reloader (:issue:1408)
• refactor socket activation and fd inheritance for better support of SystemD (:issue:1310)
• fix: o fds are given by default in gunicorn (:issue:1423)
• add ability to pass settings to GUNICORN_CMD_ARGS environment variable which helps in container world (:issue:1385)
• fix: catch access denied to pid file (:issue:1091)
• many additions and improvements to the documentation

Breaking Change
+++++++++++++++

• Python 2.6.0 is the last supported version

19.6.0

===================

Core & Logging
++++++++++++++

• improvement of the binary upgrade behaviour using USR2: remove file locking (:issue:1270)
• add the --capture-output setting to capture stdout/stderr tot the log
  file (:issue:1271)
• Allow disabling sendfile() via the SENDFILE environment variable
  (:issue:1252)
• fix reload under pycharm (:issue:1129)

Workers
+++++++

• fix: make sure to remove the signal from the worker pipe (:issue:1269)
• fix: gthread worker, handle removed socket in the select loop
  (:issue:1258)

19.5.0

===================

Core
++++

• fix: Ensure response to HEAD request won't have message body
• fix: lock domain socket and remove on last arbiter exit (:issue:1220)
• improvement: use EnvironmentError instead of socket.error (:issue:939)
• add: new FORWARDDED_ALLOW_IPS environment variable (:issue:1205)
• fix: infinite recursion when destroying sockets (:issue:1219)
• fix: close sockets on shutdown (:issue:922)
• fix: clean up sys.exc_info calls to drop circular refs (:issue:1228)
• fix: do post_worker_init after load_wsgi (:issue:1248)

Workers
+++++++

• fix access logging in gaiohttp worker (:issue:1193)
• eventlet: handle QUIT in a new coroutine (:issue:1217)
• gevent: remove obsolete exception clauses in run (:issue:1218)
• tornado: fix extra "Server" response header (:issue:1246)
• fix: unblock the wait loop under python 3.5 in sync worker (:issue:1256)

Logging
+++++++

• fix: log message for listener reloading (:issue:1181)
• Let logging module handle traceback printing (:issue:1201)
• improvement: Allow configuring logger_class with statsd_host (:issue:1188)
• fix: traceback formatting (:issue:1235)
• fix: print error logs on stderr and access logs on stdout (:issue:1184)

Documentation
+++++++++++++

• Simplify installation instructions in gunicorn.org (:issue:1072)
• Fix URL and default worker type in example_config (:issue:1209)
• update django doc url to 1.8 lts (:issue:1213)
• fix: miscellaneous wording corrections (:issue:1216)
• Add PSF License Agreement of selectors.py to NOTICE (:issue: 1226)
• document LOGGING overriding (:issue:1051)
• put a note that error logs are only errors from Gunicorn (:issue:1124)
• add a note about the requirements of the threads workers under python 2.x (:issue:1200)
• add access_log_format to config example (:issue:1251)

Tests
+++++

• Use more pytest.raises() in test_http.py

19.4.5

===================

• fix: NameError fileno in gunicorn.http.wsgi (:issue:1178)

19.4.4

===================

• fix: check if a fileobject can be used with sendfile(2) (:issue:1174)
• doc: be more descriptive in errorlog option (:issue:1173)

================
Changelog - 2017

.. note::

Please see :doc:news for the latest changes

19.4.3

===================

• fix: don't check if a file is writable using os.stat with SELINUX (:issue:1171)

19.4.2

===================

Core
++++

• improvement: handle HaltServer in manage_workers (:issue:1095)
• fix: Do not rely on sendfile sending requested count (:issue:1155)
• fix: claridy --no-sendfile default (:issue:1156)
• fix: LoggingCatch sendfile failure from no file descriptor (:issue:1160)

Logging
+++++++

• fix: Always send access log to syslog if syslog is on
• fix: check auth before trying to own a file (:issue:1157)

Documentation
+++++++++++++

• fix: Fix Slowloris broken link. (:issue:1142)
• Tweak markup in faq.rst

Testing
+++++++

• fix: gaiohttp test (:issue:1164)

19.4.1

===================

• fix tornado worker (:issue:1154)

19.4.0 / 2015/11/20

Core
++++

• fix: make sure that a user is able to access to the logs after dropping a
  privilege (:issue:1116)
• improvement: inherit the Exception class where it needs to be (:issue:997)
• fix: make sure headers are always encoded as latin1 RFC 2616 (:issue:1102)
• improvement: reduce arbiter noise (:issue:1078)
• fix: don't close the unix socket when the worker exit (:issue:1088)
• improvement: Make last logged worker count an explicit instance var (:issue:1078)
• improvement: prefix config file with its type (:issue:836)
• improvement: pidfile handing (:issue:1042)
• fix: catch OSError as well as ValueError on race condition (:issue:1052)
• improve support of ipv6 by backporting urlparse.urlsplit from Python 2.7 to
  Python 2.6.
• fix: raise InvalidRequestLine when the line contains malicious data
  (:issue:1023)
• fix: fix argument to disable sendfile
• fix: add gthread to the list of supported workers (:issue:1011)
• improvement: retry socket binding up to five times upon EADDRNOTAVAIL
  (:issue:1004)
• breaking change: only honor headers that can be encoded in ascii to comply to
  the RFC 7230 (See :issue:1151).

Logging
+++++++

• add new parameters to access log (:issue:1132)
• fix: make sure that files handles are correctly reopened on HUP
  (:issue:627)
• include request URL in error message (:issue:1071)
• get username in access logs (:issue:1069)
• fix statsd logging support on Python 3 (:issue:1010)

Testing
+++++++

• use last version of mock.
• many fixes in Travis CI support
• miscellaneous improvements in tests

Thread worker
+++++++++++++

• fix: Fix self.nr usage in ThreadedWorker so that auto restart works as
  expected (:issue:1031)

Gevent worker
+++++++++++++

• fix quit signal handling (:issue:1128)
• add support for Python 3 (:issue:1066)
• fix: make graceful shutdown thread-safe (:issue:1032)

Tornado worker
++++++++++++++

• fix ssl options (:issue:1146, :issue:1135)
• don't check timeout when stopping gracefully (:issue:1106)

AIOHttp worker
++++++++++++++

• add SSL support (:issue:1105)

Documentation
+++++++++++++

• fix link to proc name setting (:issue:1144)
• fix worker class documentation (:issue:1141, :issue:1104)
• clarify graceful timeout documentation (:issue:1137)
• don't duplicate NGINX config files examples (:issue:1050, :issue:1048)
• add web.py framework example (:issue:1117)
• update Debian/Ubuntu installations instructions (:issue:1112)
• clarify pythonpath setting description (:issue:1080)
• tweak some example for python3
• clarify sendfile documentation
• miscellaneous typos in source code comments (thanks!)
• clarify why REMOTE_ADD may not be the user's IP address (:issue:1037)

Misc
++++

• fix: reloader should survive SyntaxError (:issue:994)
• fix: expose the reloader class to the worker.

MarkupSafe 0.23 -> 1.0

1.0

---

• Fixed custom types not invoking __unicode__ when used
  with format().
• Added __version__ module attribute
• Improve unescape code to leave lone ampersands alone.

Werkzeug 0.10.4 -> 0.14.1

0.14.1

---

Released on December 31st 2017

• Resolved a regression with status code handling in the integrated
  development server.

0.14

---

Released on December 31st 2017

• HTTP exceptions are now automatically caught by
  Request.application.
• Added support for edge as browser.
• Added support for platforms that lack SpooledTemporaryFile.
• Add support for etag handling through if-match
• Added support for the SameSite cookie attribute.
• Added werkzeug.wsgi.ProxyMiddleware
• Implemented has for NullCache
• get_multi on cache clients now returns lists all the time.
• Improved the watchdog observer shutdown for the reloader to not crash
  on exit on older Python versions.
• Added support for filename* filename attributes according to
  RFC 2231
• Resolved an issue where machine ID for the reloader PIN was not
  read accurately on windows.
• Added a workaround for syntax errors in init files in the reloader.
• Added support for using the reloader with console scripts on windows.
• The built-in HTTP server will no longer close a connection in cases
  where no HTTP body is expected (204, 204, HEAD requests etc.)
• The EnvironHeaders object now skips over empty content type and
  lengths if they are set to falsy values.
• Werkzeug will no longer send the content-length header on 1xx or
  204/304 responses.
• Cookie values are now also permitted to include slashes and equal
  signs without quoting.
• Relaxed the regex for the routing converter arguments.
• If cookies are sent without values they are now assumed to have an
  empty value and the parser accepts this. Previously this could have
  corrupted cookies that followed the value.
• The test Client and EnvironBuilder now support mimetypes like
  the request object does.
• Added support for static weights in URL rules.
• Better handle some more complex reloader scenarios where sys.path
  contained non directory paths.
• EnvironHeaders no longer raises weird errors if non string keys
  are passed to it.

0.13

---

Released on December 7th 2017

• Deprecate support for Python 2.6 and 3.3. CI tests will not run
  for these versions, and support will be dropped completely in the next
  version. (pallets/meta24_)
• Raise TypeError when port is not an integer. (1088_)
• Fully deprecate werkzeug.script. Use Click_ instead. (1090_)
• response.age is parsed as a timedelta. Previously, it was
  incorrectly treated as a datetime. The header value is an integer
  number of seconds, not a date string. (414_)
• Fix a bug in TypeConversionDict where errors are not propagated
  when using the converter. (1102_)
• Authorization.qop is a string instead of a set, to comply with
  RFC 2617. (984_)
• An exception is raised when an encoded cookie is larger than, by
  default, 4093 bytes. Browsers may silently ignore cookies larger than
  this. BaseResponse has a new attribute max_cookie_size and
  dump_cookie has a new argument max_size to configure this.
  (780, 1109)
• Fix a TypeError in werkzeug.contrib.lint.GuardedIterator.close.
  (1116_)
• BaseResponse.calculate_content_length now correctly works for
  Unicode responses on Python 3. It first encodes using
  iter_encoded. (705_)
• Secure cookie contrib works with string secret key on Python 3.
  (1205_)
• Shared data middleware accepts a list instead of a dict of static
  locations to preserve lookup order. (1197_)
• HTTP header values without encoding can contain single quotes.
  (1208_)
• The built-in dev server supports receiving requests with chunked
  transfer encoding. (1198_)

.. _Click: https://www.palletsprojects.com/p/click/
.. _pallets/meta24: https://github.com/pallets/meta/issues/24
.. _414: pallets/werkzeug#414
.. _705: pallets/werkzeug#705
.. _780: pallets/werkzeug#780
.. _984: pallets/werkzeug#984
.. _1088: pallets/werkzeug#1088
.. _1090: pallets/werkzeug#1090
.. _1102: pallets/werkzeug#1102
.. _1109: pallets/werkzeug#1109
.. _1116: pallets/werkzeug#1116
.. _1197: pallets/werkzeug#1197
.. _1198: pallets/werkzeug#1198
.. _1205: pallets/werkzeug#1205
.. _1208: pallets/werkzeug#1208

0.12.2

---

Released on May 16 2017

• Fix regression: Pull request 892 prevented Werkzeug from correctly
  logging the IP of a remote client behind a reverse proxy, even when using
  ProxyFix.
• Fix a bug in safe_join on Windows.

0.12.1

---

Released on March 15th 2017

• Fix crash of reloader (used on debug mode) on Windows.
  (OSError: [WinError 10038]). See pull request 1081
• Partially revert change to class hierarchy of Headers. See 1084.

0.12

---

Released on March 10th 2017

• Spit out big deprecation warnings for werkzeug.script
• Use inspect.getfullargspec internally when available as
  inspect.getargspec is gone in 3.6
• Added support for status code 451 and 423
• Improved the build error suggestions. In particular only if
  someone stringifies the error will the suggestions be calculated.
• Added support for uWSGI's caching backend.
• Fix a bug where iterating over a FileStorage would result in an infinite
  loop.
• Datastructures now inherit from the relevant baseclasses from the
  collections module in the stdlib. See 794.
• Add support for recognizing NetBSD, OpenBSD, FreeBSD, DragonFlyBSD platforms
  in the user agent string.
• Recognize SeaMonkey browser name and version correctly
• Recognize Baiduspider, and bingbot user agents
• If LocalProxy's wrapped object is a function, refer to it with wrapped
  attribute.
• The defaults of generate_password_hash have been changed to more secure
  ones, see pull request 753.
• Add support for encoding in options header parsing, see pull request
  933.
• test.Client now properly handles Location headers with relative URLs, see
  pull request 879.
• When HTTPException is raised, it now prints the description, for easier
  debugging.
• Werkzeug's dict-like datastructures now have view-methods under Python 2,
  see pull request 968.
• Fix a bug in MultiPartParser when no stream_factory was provided
  during initialization, see pull request 973.
• Disable autocorrect and spellchecker in the debugger middleware's Python
  prompt, see pull request 994.
• Don't redirect to slash route when method doesn't match, see pull request
  907.
• Fix a bug when using SharedDataMiddleware with frozen packages, see pull
  request 959.
• Range header parsing function fixed for invalid values 974.
• Add support for byte Range Requests, see pull request 978.
• Use modern cryptographic defaults in the dev servers 1004.
• the post() method of the test client now accept file object through the data
  parameter.
• Color run_simple's terminal output based on HTTP codes 1013.
• Fix self-XSS in debugger console, see 1031.
• Fix IPython 5.x shell support, see 1033.
• Change Accept datastructure to sort by specificity first, allowing for more
  accurate results when using best_match for mime types (for example in
  requests.accept_mimetypes.best_match)

0.11.16

---

• werkzeug.serving: set CONTENT_TYPE / CONTENT_LENGTH if only they're provided by the client
• werkzeug.serving: Fix crash of reloader when using python -m werkzeug.serving.

0.11.15

---

Released on December 30th 2016.

• Bugfix for the bugfix in the previous release.

0.11.14

---

Released on December 30th 2016.

• Check if platform can fork before importing ForkingMixIn, raise exception
  when creating ForkingWSGIServer on such a platform, see PR 999.

0.11.13

---

Released on December 26th 2016.

• Correct fix for the reloader issuer on certain Windows installations.

0.11.12

---

Released on December 26th 2016.

• Fix more bugs in multidicts regarding empty lists. See 1000.
• Add some docstrings to some EnvironBuilder properties that were previously
  unintentionally missing.
• Added a workaround for the reloader on windows.

0.11.11

---

Released on August 31st 2016.

• Fix JSONRequestMixin for Python3. See 731
• Fix broken string handling in test client when passing integers. See 852
• Fix a bug in parse_options_header where an invalid content type
  starting with comma or semi-colon would result in an invalid return value,
  see issue 995.
• Fix a bug in multidicts when passing empty lists as values, see issue
  979.
• Fix a security issue that allows XSS on the Werkzeug debugger. See 1001.

0.11.10

---

Released on May 24th 2016.

• Fixed a bug that occurs when running on Python 2.6 and using a broken locale.
  See pull request 912.
• Fixed a crash when running the debugger on Google App Engine. See issue 925.
• Fixed an issue with multipart parsing that could cause memory exhaustion.

0.11.9

---

Released on April 24th 2016.

• Corrected an issue that caused the debugger not to use the
  machine GUID on POSIX systems.
• Corrected a Unicode error on Python 3 for the debugger's
  PIN usage.
• Corrected the timestamp verification in the pin debug code.
  Without this fix the pin was remembered for too long.

0.11.8

---

Released on April 15th 2016.

• fixed a problem with the machine GUID detection code on OS X
  on Python 3.

0.11.7

---

Released on April 14th 2016.

• fixed a regression on Python 3 for the debugger.

0.11.6

---

Released on April 14th 2016.

• werkzeug.serving: Still show the client address on bad requests.
• improved the PIN based protection for the debugger to make it harder to
  brute force via trying cookies. Please keep in mind that the debugger
  is not intended for running on production environments
• increased the pin timeout to a week to make it less annoying for people
  which should decrease the chance that users disable the pin check
  entirely.
• werkzeug.serving: Fix broken HTTP_HOST when path starts with double slash.

0.11.5

---

Released on March 22nd 2016.

• werkzeug.serving: Fix crash when attempting SSL connection to HTTP server.

0.11.4

---

Released on February 14th 2016.

• Fixed werkzeug.serving not working from -m flag.
• Fixed incorrect weak etag handling.

0.11.3

---

Released on December 20th 2015.

• Fixed an issue with copy operations not working against
  proxies.
• Changed the logging operations of the development server to
  correctly log where the server is running in all situations
  again.
• Fixed another regression with SSL wrapping similar to the
  fix in 0.11.2 but for a different code path.

0.11.2

---

Released on November 12th 2015.

• Fix inheritable sockets on Windows on Python 3.
• Fixed an issue with the forking server not starting any longer.
• Fixed SSL wrapping on platforms that supported opening sockets
  by file descriptor.
• No longer log from the watchdog reloader.
• Unicode errors in hosts are now better caught or converted into
  bad request errors.

0.11.1

---

Released on November 10th 2015.

• Fixed a regression on Python 3 in the debugger.

0.11

---

Released on November 8th 2015, codename Gleisbaumaschine.

• Added reloader_paths option to run_simple and other functions in
  werkzeug.serving. This allows the user to completely override the Python
  module watching of Werkzeug with custom paths.
• Many custom cached properties of Werkzeug's classes are now subclasses of
  Python's property type (issue 616).
• bind_to_environ now doesn't differentiate between implicit and explicit
  default port numbers in HTTP_HOST (pull request 204).
• BuildErrors are now more informative. They come with a complete sentence
  as error message, and also provide suggestions (pull request 691).
• Fix a bug in the user agent parser where Safari's build number instead of
  version would be extracted (pull request 703).
• Fixed issue where RedisCache set_many was broken for twemproxy, which doesn't
  support the default MULTI command (pull request 702).
• mimetype parameters on request and response classes are now always
  converted to lowercase.
• Changed cache so that cache never expires if timeout is 0. This also fixes
  an issue with redis setex (issue 550)
• Werkzeug now assumes UTF-8 as filesystem encoding on Unix if Python
  detected it as ASCII.
• New optional has method on caches.
• Fixed various bugs in parse_options_header (pull request 643).
• If the reloader is enabled the server will now open the socket in the parent
  process if this is possible. This means that when the reloader kicks in
  the connection from client will wait instead of tearing down. This does
  not work on all Python versions.
• Implemented PIN based authentication for the debugger. This can optionally
  be disabled but is discouraged. This change was necessary as it has been
  discovered that too many people run the debugger in production.
• Devserver no longer requires SSL module to be installed.

0.10.5

---

(bugfix release, release date yet to be decided)

• Reloader: Correctly detect file changes made by moving temporary files over
  the original, which is e.g. the case with PyCharm (pull request 722).
• Fix bool behavior of werkzeug.datastructures.ETags under Python 3 (issue
  744).

Once you have closed this pull request, I'll create separate pull requests for every update as soon as I find them.

That's it for now!

Happy merging! 🤖