chore(deps): update dependency werkzeug to v3.1.5 - autoclosed

[mend-for-github-com]

This PR contains the following updates:

Package	Update	Change
werkzeug (changelog)	minor	==3.0.6 → ==3.1.5

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	Vulnerability
Medium	5.3	CVE-2025-66221
Medium	5.3	CVE-2026-21860

---

Release Notes

pallets/werkzeug (werkzeug)

v3.1.5

Compare Source

Released 2026-01-08

• safe_join on Windows does not allow more special device names, regardless
  of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  This fixes the previous attempt, which caused incorrect content lengths.
  :issue:3065 :issue:3077
• Fix AttributeError when initializing DebuggedApplication with
  pin_security=False. :issue:3075

v3.1.4

Compare Source

Released 2025-11-28

• safe_join on Windows does not allow special device names. This prevents
  reading from these when using send_from_directory. secure_filename
  already prevented writing to these. :ghsa:hgf8-39gv-g3f2
• The debugger pin fails after 10 attempts instead of 11. :pr:3020
• The multipart form parser handles a \r\n sequence at a chunk boundary.
  :issue:3065
• Improve CPU usage during Watchdog reloader. :issue:3054
• Request.json annotation is more accurate. :issue:3067
• Traceback rendering handles when the line number is beyond the available
  source lines. :issue:3044
• HTTPException.get_response annotation and doc better conveys the
  distinction between WSGI and sans-IO responses. :issue:3056

v3.1.3

Compare Source

Released 2024-11-08

• Initial data passed to MultiDict and similar interfaces only accepts
  list, tuple, or set when passing multiple values. It had been
  changed to accept any Collection, but this matched types that should be
  treated as single values, such as bytes. :issue:2994
• When the Host header is not set and Request.host falls back to the
  WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped
  in [] to match the Host header. :issue:2993

v3.1.2

Compare Source

Released 2024-11-04

• Improve type annotation for TypeConversionDict.get to allow the type
  parameter to be a callable. :issue:2988
• Headers does not inherit from MutableMapping, as it is does not
  exactly match that interface. :issue:2989

v3.1.1

Compare Source

Released 2024-11-01

• Fix an issue that caused str(Request.headers) to always appear empty.
  :issue:2985

v3.1.0

Compare Source

Released 2024-10-31

• Drop support for Python 3.8. :pr:2966

• Remove previously deprecated code. :pr:2967

• Request.max_form_memory_size defaults to 500kB instead of unlimited.
  Non-file form fields over this size will cause a RequestEntityTooLarge
  error. :issue:2964

• OrderedMultiDict and ImmutableOrderedMultiDict are deprecated.
  Use MultiDict and ImmutableMultiDict instead. :issue:2968

• Behavior of properties on request.cache_control and
  response.cache_control has been significantly adjusted.

  • Dict values are always str | None. Setting properties will convert
    the value to a string. Setting a property to False is equivalent to
    setting it to None. Getting typed properties will return None if
    conversion raises ValueError, rather than the string. :issue:2980
  • max_age is None if present without a value, rather than -1.
    :issue:2980
  • no_cache is a boolean for requests, it is True instead of
    "*" when present. It remains a string for responses. :issue:2980
  • max_stale is True if present without a value, rather
    than "*". :issue:2980
  • no_transform is a boolean. Previously it was mistakenly always
    None. :issue:2881
  • min_fresh is None if present without a value, rather than
    "*". :issue:2881
  • private is True if present without a value, rather than "*".
    :issue:2980
  • Added the must_understand property. :issue:2881
  • Added the stale_while_revalidate, and stale_if_error
    properties. :issue:2948
  • Type annotations more accurately reflect the values. :issue:2881

• Support Cookie CHIPS (Partitioned Cookies). :issue:2797

• Add 421 MisdirectedRequest HTTP exception. :issue:2850

• Increase default work factor for PBKDF2 to 1,000,000 iterations.
  :issue:2969

• Inline annotations for datastructures, removing stub files.
  :issue:2970

• MultiDict.getlist catches TypeError in addition to ValueError
  when doing type conversion. :issue:2976

• Implement | and |= operators for MultiDict, Headers, and
  CallbackDict, and disallow |= on immutable types. :issue:2977

---

• If you want to rebase/retry this PR, check this box

[github-actions]

Unit Test Results

  3 014 files  ±0    3 014 suites  ±0   1h 29m 55s ⏱️ +29s
12 406 tests +1  12 398 ✔️ +1    7 💤 ±0  1 ❌ ±0 
28 065 runs  ±0  28 049 ✔️ ±0  15 💤 ±0  1 ❌ ±0 

For more details on these failures, see this check.

Results for commit 55fd592. ± Comparison against base commit ea291df.

♻️ This comment has been updated with latest results.