fix(deps): update dependency werkzeug to v3.1.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Werkzeug (changelog)	3.0.6 → 3.1.6

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

GitHub Vulnerability Alerts

CVE-2025-66221

Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

CVE-2026-21860

Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON .

This was previously reported as GHSA-hgf8-39gv-g3f2, but the fix failed to account for compound extensions such as CON.txt.html or trailing spaces. It also missed some additional special names.

send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

CVE-2026-27199

Werkzeug's safe_join function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.

send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

---

Werkzeug safe_join() allows Windows special device names

CVE-2025-66221 / GHSA-hgf8-39gv-g3f2

More information

Details

Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221
• https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13
• https://github.com/pallets/werkzeug
• https://github.com/pallets/werkzeug/releases/tag/3.1.4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Werkzeug safe_join() allows Windows special device names with compound extensions

CVE-2026-21860 / GHSA-87hc-h4r5-73f7

More information

Details

Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON .

This was previously reported as GHSA-hgf8-39gv-g3f2, but the fix failed to account for compound extensions such as CON.txt.html or trailing spaces. It also missed some additional special names.

send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7
• https://nvd.nist.gov/vuln/detail/CVE-2026-21860
• https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3
• https://github.com/pallets/werkzeug

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Werkzeug safe_join() allows Windows special device names

CVE-2026-27199 / GHSA-29vq-49wr-vm6x

More information

Details

Werkzeug's safe_join function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.

send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x
• https://nvd.nist.gov/vuln/detail/CVE-2026-27199
• https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d
• https://github.com/pallets/werkzeug
• https://github.com/pallets/werkzeug/releases/tag/3.1.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/werkzeug (Werkzeug)

v3.1.6

Compare Source

Released 2026-02-19

• safe_join on Windows does not allow special devices names in
  multi-segment paths. :ghsa:29vq-49wr-vm6x

v3.1.5

Compare Source

Released 2026-01-08

• safe_join on Windows does not allow more special device names, regardless
  of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  This fixes the previous attempt, which caused incorrect content lengths.
  :issue:3065 :issue:3077
• Fix AttributeError when initializing DebuggedApplication with
  pin_security=False. :issue:3075

v3.1.4

Compare Source

Released 2025-11-28

• safe_join on Windows does not allow special device names. This prevents
  reading from these when using send_from_directory. secure_filename
  already prevented writing to these. :ghsa:hgf8-39gv-g3f2
• The debugger pin fails after 10 attempts instead of 11. :pr:3020
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  :issue:3065
• Improve CPU usage during Watchdog reloader. :issue:3054
• Request.json annotation is more accurate. :issue:3067
• Traceback rendering handles when the line number is beyond the available
  source lines. :issue:3044
• HTTPException.get_response annotation and doc better conveys the
  distinction between WSGI and sans-IO responses. :issue:3056

v3.1.3

Compare Source

Released 2024-11-08

• Initial data passed to MultiDict and similar interfaces only accepts
  list, tuple, or set when passing multiple values. It had been
  changed to accept any Collection, but this matched types that should be
  treated as single values, such as bytes. :issue:2994
• When the Host header is not set and Request.host falls back to the
  WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped
  in [] to match the Host header. :issue:2993

v3.1.2

Compare Source

Released 2024-11-04

• Improve type annotation for TypeConversionDict.get to allow the type
  parameter to be a callable. :issue:2988
• Headers does not inherit from MutableMapping, as it is does not
  exactly match that interface. :issue:2989

v3.1.1

Compare Source

Released 2024-11-01

• Fix an issue that caused str(Request.headers) to always appear empty.
  :issue:2985

v3.1.0

Compare Source

Released 2024-10-31

• Drop support for Python 3.8. :pr:2966

• Remove previously deprecated code. :pr:2967

• Request.max_form_memory_size defaults to 500kB instead of unlimited.
  Non-file form fields over this size will cause a RequestEntityTooLarge
  error. :issue:2964

• OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
  Use MultiDict and ImmutableMultiDict instead. :issue:2968

• Behavior of properties on request.cache_control and
  response.cache_control has been significantly adjusted.

  • Dict values are always str | None. Setting properties will convert
    the value to a string. Setting a property to False is equivalent to
    setting it to None. Getting typed properties will return None if
    conversion raises ValueError, rather than the string. :issue:2980
  • max_age is None if present without a value, rather than -1.
    :issue:2980
  • no_cache is a boolean for requests, it is True instead of
    "*" when present. It remains a string for responses. :issue:2980
  • max_stale is True if present without a value, rather
    than "*". :issue:2980
  • no_transform is a boolean. Previously it was mistakenly always
    None. :issue:2881
  • min_fresh is None if present without a value, rather than
    "*". :issue:2881
  • private is True if present without a value, rather than "*".
    :issue:2980
  • Added the must_understand property. :issue:2881
  • Added the stale_while_revalidate, and stale_if_error
    properties. :issue:2948
  • Type annotations more accurately reflect the values. :issue:2881

• Support Cookie CHIPS (Partitioned Cookies). :issue:2797

• Add 421 MisdirectedRequest HTTP exception. :issue:2850

• Increase default work factor for PBKDF2 to 1,000,000 iterations.
  :issue:2969

• Inline annotations for datastructures, removing stub files.
  :issue:2970

• MultiDict.getlist catches TypeError in addition to ValueError
  when doing type conversion. :issue:2976

• Implement | and |= operators for MultiDict, Headers, and
  CallbackDict, and disallow |= on immutable types. :issue:2977

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/Montreal, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Updating dependencies
Resolving dependencies...


Because notifications-utils (53.2.15) @ git+https://github.com/cds-snc/notifier-utils.git@53.2.15 depends on both werkzeug (3.0.6) and werkzeug (3.0.6), werkzeug is required.
So, because notification-api depends on Werkzeug (3.1.6), version solving failed.